Skip to content

Commit b3c1523

Browse files
GrantBirkiCopilot
andauthored
Update lib/hooks/plugins/request_validator/shared_secret.rb
Co-authored-by: Copilot <[email protected]>
1 parent d906144 commit b3c1523

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

lib/hooks/plugins/request_validator/shared_secret.rb

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,14 +78,17 @@ def self.valid?(payload:, headers:, secret:, config:)
7878

7979
return false if raw_secret.nil? || raw_secret.empty?
8080

81+
# Cache the stripped value of raw_secret
82+
stripped_secret = raw_secret.strip
83+
8184
# Security: Reject secrets with leading/trailing whitespace
82-
return false if raw_secret != raw_secret.strip
85+
return false if raw_secret != stripped_secret
8386

8487
# Security: Reject secrets containing null bytes or other control characters
8588
return false if raw_secret.match?(/[\u0000-\u001f\u007f-\u009f]/)
8689

8790
# Use secure comparison to prevent timing attacks
88-
Rack::Utils.secure_compare(secret, raw_secret.strip)
91+
Rack::Utils.secure_compare(secret, stripped_secret)
8992
rescue StandardError => _e
9093
# Log error in production - for now just return false
9194
false

0 commit comments

Comments
 (0)