From 047bd5f6c7569cec8bc302c905593348e206a60f Mon Sep 17 00:00:00 2001 From: SchiZzA Date: Wed, 27 May 2026 21:41:40 +0200 Subject: [PATCH] hmac compare ID / KEY --- custom_components/sws12500/__init__.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/custom_components/sws12500/__init__.py b/custom_components/sws12500/__init__.py index 54ef515..e04f9c6 100644 --- a/custom_components/sws12500/__init__.py +++ b/custom_components/sws12500/__init__.py @@ -26,6 +26,7 @@ With a high-frequency push source (webhook), a reload at the wrong moment can le period where no entities are subscribed, causing stale states until another full reload/restart. """ +import hmac import logging from typing import Any @@ -296,7 +297,13 @@ class WeatherDataUpdateCoordinator(DataUpdateCoordinator): ) raise IncorrectDataError - if id_data != _id or key_data != _key: + # Constant-time comaprision to avoid lekaing credential length/content via timig. + # Both operands are compared even if the first fails, so the branch order doesn't + # short-circut. Encode to bytes so non-ASCII credentials are handeled safely. + + id_ok = hmac.compare_digest(id_data.encode("utf-8"), _id.encode("utf-8")) + key_ok = hmac.compare_digest(key_data.encode("utf-8"), _key.encode("utf-8")) + if not (id_ok & key_ok): _LOGGER.error("Unauthorised access!") if health: health.update_ingress_result(