From ed0a69185f2266a8794f0d2df5a624708c1980c9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 25 Mar 2026 13:57:34 +0000 Subject: [PATCH] Fix timing attack in password comparison using constant-time XOR Co-authored-by: milutinke <441903+milutinke@users.noreply.github.com> Agent-Logs-Url: https://github.com/MCCTeam/Minecraft-Console-Client/sessions/c762752f-46be-44f6-a05d-8c5effc8ef43 --- MinecraftClient/config/ChatBots/WebSocketBot.cs | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/MinecraftClient/config/ChatBots/WebSocketBot.cs b/MinecraftClient/config/ChatBots/WebSocketBot.cs index 875daa58..7cfa0a1a 100644 --- a/MinecraftClient/config/ChatBots/WebSocketBot.cs +++ b/MinecraftClient/config/ChatBots/WebSocketBot.cs @@ -1089,7 +1089,21 @@ public class WebSocketBot : ChatBot private void HandleAuthenticate(string sessionId, WebSocketSession session, string requestId, List parameters) { - if (parameters.Count == 0 || GetParam(parameters, 0) != _password) + if (parameters.Count == 0) + { + SendCommandResponse(sessionId, requestId, false, "Invalid password"); + return; + } + + var provided = GetParam(parameters, 0); + var expected = _password; + + // Fixed-time comparison to prevent timing attacks + var diff = provided.Length ^ expected.Length; + for (int i = 0; i < expected.Length; i++) + diff |= expected[i] ^ (i < provided.Length ? provided[i] : 0xFF); + + if (diff != 0) { SendCommandResponse(sessionId, requestId, false, "Invalid password"); return;