LaLeV/wacrm
1
0
Fork 0
mirror of https://github.com/Luchexx/wacrm.git synced 2026-11-02 09:19:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #396 from opastorello/fix/cron-timing-safe

Browse Source 
fix: use timing-safe compare for cron secret
This commit is contained in:
Arnas Donauskas 2026-07-17 12:48:10 +03:00 committed by GitHub
commit 96e60adecf
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/app/api/automations/cron/route.ts
View File

@ -1,3 +1,4 @@
import { timingSafeEqual } from 'node:crypto'
import { NextResponse } from 'next/server' import { NextResponse } from 'next/server'
import { supabaseAdmin } from '@/lib/automations/admin-client' import { supabaseAdmin } from '@/lib/automations/admin-client'
import { resumePendingExecution } from '@/lib/automations/engine' import { resumePendingExecution } from '@/lib/automations/engine'
@ -19,8 +20,13 @@ export async function GET(request: Request) {
if (!expected) { if (!expected) {
return NextResponse.json({ error: 'cron not configured' }, { status: 503 }) return NextResponse.json({ error: 'cron not configured' }, { status: 503 })
} }
const supplied = request.headers.get('x-cron-secret') const supplied = request.headers.get('x-cron-secret') ?? ''
if (supplied !== expected) { const suppliedBuf = Buffer.from(supplied)
const expectedBuf = Buffer.from(expected)
if (
suppliedBuf.length !== expectedBuf.length ||
!timingSafeEqual(suppliedBuf, expectedBuf)
) {
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
} }