🛡️ Sentinel: [security improvement] Fix timing attack vulnerability in token comparisons

[hackerxj2010]

🛡️ Sentinel: [security improvement] Fix timing attack vulnerability in token comparisons

🚨 Severity

MEDIUM

💡 Vulnerability

The application was using standard string comparison (!== and ===) for sensitive tokens and signatures. Standard string comparison is susceptible to timing attacks, where an attacker can infer the value of a secret by measuring how long the comparison takes (as it typically returns as soon as it finds a mismatching character).

🎯 Impact

An attacker could potentially brute-force internal service tokens or forge OAuth state signatures by observing timing differences in the server's response. This would allow them to bypass internal service authentication or interfere with the OAuth flow.

🔧 Fix

1. Implemented a safeCompare utility in packages/platform/src/index.ts.
2. The utility hashes both inputs using SHA-256 (handling different length strings securely) and then compares the hashes using Node.js's crypto.timingSafeEqual, which runs in constant time.
3. Updated assertInternalRequest (used across most microservices) and AuthService.verifyOAuthState to use this secure comparison.

✅ Verification

• Created a new unit test suite tests/unit/platform-security.test.ts to verify safeCompare correctly identifies matches and mismatches while handling edge cases like undefined and varying string lengths.
• Executed existing auth-service tests to confirm that normal authentication and OAuth state verification still work correctly.
• Validated that the changes comply with the project's linting rules.

---

PR created automatically by Jules for task 14114205297027665869 started by @hackerxj2010

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.