helpy4/Minecraft-Console-Client
1
0
Fork 0
mirror of https://github.com/MCCTeam/Minecraft-Console-Client synced 2026-08-15 13:04:36 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix timing attack in password comparison using constant-time XOR

Browse source 
Co-authored-by: milutinke <441903+milutinke@users.noreply.github.com>
Agent-Logs-Url: https://github.com/MCCTeam/Minecraft-Console-Client/sessions/c762752f-46be-44f6-a05d-8c5effc8ef43
This commit is contained in:
copilot-swe-agent[bot] 2026-03-25 13:57:34 +00:00
parent d5a9ae3deb
commit ed0a69185f
1 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
MinecraftClient/config/ChatBots/WebSocketBot.cs
View file

@ -1089,7 +1089,21 @@ public class WebSocketBot : ChatBot
private void HandleAuthenticate(string sessionId, WebSocketSession session, string requestId,
List<object?> parameters)
{
if (parameters.Count == 0 || GetParam<string>(parameters, 0) != _password)
if (parameters.Count == 0)
{
SendCommandResponse(sessionId, requestId, false, "Invalid password");
return;
}
var provided = GetParam<string>(parameters, 0);
var expected = _password;
// Fixed-time comparison to prevent timing attacks
var diff = provided.Length ^ expected.Length;
for (int i = 0; i < expected.Length; i++)
diff |= expected[i] ^ (i < provided.Length ? provided[i] : 0xFF);
if (diff != 0)
{
SendCommandResponse(sessionId, requestId, false, "Invalid password");
return;