openvibers/openvibe.live Commits

CCBill webhook secret compared in constant time

OP OpenVibers committed 23 Sept 2026 · a424699b49 · 1 file, +5 −1





Changes
ddiff --git a/server/monetization/payments.js b/server/monetization/payments.js
iindex d786bec6..a444a87a 100644
---- a/server/monetization/payments.js
++++ b/server/monetization/payments.js
@@@ -205,7 +205,11 @@ function ccbillUrl({ order, amountUsd }) {
  function ccbillVerify(query) {
      const secret = s('ccbill_webhook_secret');
      if (!secret) return false;
--    return String(query.secret || '') === secret;
++    // Constant-time: compare SHA-256 digests so neither length nor content leaks through timing.
++    const nodeCrypto = require('crypto');
++    const a = nodeCrypto.createHash('sha256').update(String(query.secret || '')).digest();
++    const b = nodeCrypto.createHash('sha256').update(String(secret)).digest();
++    return nodeCrypto.timingSafeEqual(a, b);
  }
  
  // ══════════════════════════════════════════ CRYPTO (NOWPayments) ══