🛡️ Sentinel: Harden auth comparison and filter Telegram secrets#45
🛡️ Sentinel: Harden auth comparison and filter Telegram secrets#45SuvenSeo wants to merge 1 commit into
Conversation
- Move `safeEqual` to `frontend/src/lib/security/crypto.js` and harden against timing side-channel attacks by hashing inputs with SHA-256 before comparison. - Add sensitive content filtering to incoming Telegram messages in `messageHandler.js` to prevent secret persistence. - Add security verification test suite in `frontend/tests/security.test.js`. - Update Sentinel security journal with findings and prevention strategies. Co-authored-by: SuvenSeo <263689617+SuvenSeo@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
There was a problem hiding this comment.
Pull request overview
This PR hardens authentication secret comparison and adds Telegram sensitive-content rejection to reduce timing-oracle and credential-persistence risks.
Changes:
- Moves
safeEqualto a new security crypto helper that hashes inputs beforetimingSafeEqual. - Adds Telegram message rejection for sensitive-looking content before normal message persistence/processing.
- Adds security-focused tests and a Sentinel audit note.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
frontend/src/lib/security/crypto.js |
Adds the new hashed safeEqual helper. |
frontend/src/lib/middleware/auth.js |
Imports safeEqual from the new crypto module. |
frontend/src/app/api/auth/session/route.js |
Updates session auth to use the new safeEqual import. |
frontend/src/app/api/telegram/webhook/route.js |
Updates Telegram webhook secret validation import. |
frontend/src/lib/handlers/messageHandler.js |
Adds Telegram sensitive-content rejection before main handling. |
frontend/tests/security.test.js |
Adds tests for safeEqual and sensitive-content detection. |
.jules/sentinel.md |
Adds an audit log entry describing the hardening work. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| const { safeEqual } = require('../src/lib/security/crypto'); | ||
| const { hasSensitiveContent } = require('../src/lib/security/sensitiveContent'); |
|
|
||
| // ── Main Message Handler ────────────────────────────────────────────────────── | ||
| export async function handleMessage(chatId, text, messageId) { | ||
| if (hasSensitiveContent(text)) { |
| * Constant-time comparison for secrets. | ||
| * To prevent leaking the length of the secret via timing, hash both inputs | ||
| * with SHA-256 before constant-time comparison. |
🚨 Severity: MEDIUM/HIGH
💡 Vulnerability:
safeEqualwas susceptible to timing side-channel attacks as it leaked the secret length via a preliminary length check and potentially viatimingSafeEqual's requirement for matching lengths.🎯 Impact:
🔧 Fix:
safeEqualto hash both inputs using SHA-256 before performing a constant-time comparison. This ensures uniform length and timing regardless of original input length.hasSensitiveContentcheck into the TelegramhandleMessageflow, rejecting messages with secrets before they are logged or processed.✅ Verification:
frontend/tests/security.test.jswhich verifiessafeEqualhandles various input scenarios (matching, mismatching, different lengths) and thathasSensitiveContentcorrectly identifies common secret patterns.npm test), all 42 tests passed.PR created automatically by Jules for task 6580909326544627956 started by @SuvenSeo