mudhorn/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2024-11-13 16:14:07 -08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

fix(Telegram Trigger Node): Use timing-safe string comparison (no-changelog) (#10718)

Browse source
This commit is contained in:
Shireen Missi 2024-09-10 13:02:38 +01:00 committed by GitHub
parent 421aa71251
commit 540f79a38f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
packages/nodes-base/nodes/Telegram/TelegramTrigger.node.ts
View file

@ -1,3 +1,4 @@
import crypto from 'crypto';
import type { import type {
IHookFunctions, IHookFunctions,
IWebhookFunctions, IWebhookFunctions,
@ -233,7 +234,11 @@ export class TelegramTrigger implements INodeType {
const nodeVersion = this.getNode().typeVersion; const nodeVersion = this.getNode().typeVersion;
if (nodeVersion > 1) { if (nodeVersion > 1) {
const secret = getSecretToken.call(this); const secret = getSecretToken.call(this);
if (secret !== headerData['x-telegram-bot-api-secret-token']) { const secretBuffer = Buffer.from(secret);
const headerSecretBuffer = Buffer.from(
String(headerData['x-telegram-bot-api-secret-token'] ?? ''),
);
if (!crypto.timingSafeEqual(secretBuffer, headerSecretBuffer)) {
const res = this.getResponseObject(); const res = this.getResponseObject();
res.status(403).json({ message: 'Provided secret is not valid' }); res.status(403).json({ message: 'Provided secret is not valid' });
return { return {