ZaclysIndustries
/
searxngRebrandZaclys
forked from zaclys/searxng
2
0
Fork 0
Code Issues Pull Requests Activity

[fix] use hmac.compare_digest instead of == 

see https://docs.python.org/3/library/hmac.html#hmac.HMAC.hexdigest
This commit is contained in:
Alexandre Flament 2021-12-28 08:36:31 +01:00
parent c6922ae7c5
commit d784870209
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
searx/webapp.py
View File

@ -1067,8 +1067,9 @@ def image_proxy():
if not url:
return '', 400
h = new_hmac(settings['server']['secret_key'], url.encode())
if h != request.args.get('h'):
h_url = new_hmac(settings['server']['secret_key'], url.encode())
h_args = request.args.get('h')
if len(h_url) != len(h_args) or not hmac.compare_digest(h_url, h_args):
return '', 400
maximum_size = 5 * 1024 * 1024