From ddecd1e65a4b277e6793ff8d758da742011c4e8b Mon Sep 17 00:00:00 2001 From: Matthew Meszaros Date: Wed, 21 Oct 2026 06:38:13 +0200 Subject: [PATCH] feat: compare presented SMTP and IMAP passwords with crypto/subtle.ConstantTimeCompare when pool link enrollment adopts the workspace's existing Cloud mailbox --- internal/app/poollink/service.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/internal/app/poollink/service.go b/internal/app/poollink/service.go index d402e0abe..cdb59407c 100644 --- a/internal/app/poollink/service.go +++ b/internal/app/poollink/service.go @@ -5,6 +5,7 @@ import ( "context" "crypto/rand" "crypto/sha256" + "crypto/subtle" "encoding/base64" "encoding/hex" "errors" @@ -581,7 +582,8 @@ func sameSMTPIMAPCredentials(stored *repository.SMTPCredentials, got *models.Smt } same := func(host string, port int, user, password string, svc *models.Service) bool { return strings.EqualFold(strings.TrimSpace(host), strings.TrimSpace(svc.Host)) && port == svc.Port && - strings.TrimSpace(user) == strings.TrimSpace(svc.Username) && password == svc.Password + strings.TrimSpace(user) == strings.TrimSpace(svc.Username) && + subtle.ConstantTimeCompare([]byte(password), []byte(svc.Password)) == 1 } return same(stored.SMTPHost, stored.SMTPPort, stored.SMTPUser, stored.SMTPPassword, got.SMTP) && same(stored.IMAPHost, stored.IMAPPort, stored.IMAPUser, stored.IMAPPassword, got.IMAP)