potiuk opened a new pull request, #66556: URL: https://github.com/apache/airflow/pull/66556
## Summary The SimpleAuthManager login service compared submitted passwords against the stored value with `==`, which short-circuits on the first differing character and leaks password length / prefix information through timing analysis. Switch to `hmac.compare_digest()` so the comparison runs in constant time regardless of where the strings diverge, and use `.get(user.username, "")` so a user record without a corresponding password entry compares against an empty string rather than raising `KeyError`. SimpleAuthManager is dev-only, but the threat model the audit raised (timing analysis from a co-located process or local network) is plausible even in dev, and the fix is one line. ASVS L1/L2/L3 § 6.3.1 / CWE-208. Tests added for wrong-password and unknown-username rejection. ## Reported by L3 ASVS sweep — apache/tooling-agents#23 (FINDING-008). --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.7) Generated-by: Claude Code (Opus 4.7) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
