(cxf) branch 4.1.x-fixes updated: compare oauth2 secret tokens with constant-time MessageDigest.isEqual (#3165)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/4.1.x-fixes by this push:
     new 6370ed653e0 compare oauth2 secret tokens with constant-time 
MessageDigest.isEqual (#3165)
6370ed653e0 is described below

commit 6370ed653e0e26d1da77230665e15e2d356a0b1e
Author: Javid Khan <dxbja...@gmail.com>
AuthorDate: Tue Jun 2 12:53:19 2026 +0530

    compare oauth2 secret tokens with constant-time MessageDigest.isEqual 
(#3165)
    
    (cherry picked from commit 5e96ddb0d940b23af13e3771bc8979c3ce36f2aa)
---
 .../rs/security/oauth2/client/MemoryClientCodeStateManager.java    | 2 +-
 .../rs/security/oauth2/services/DynamicRegistrationService.java    | 4 ++--
 .../rs/security/oauth2/services/RedirectionBasedGrantService.java  | 2 +-
 .../java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java   | 7 +++++++
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/MemoryClientCodeStateManager.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/MemoryClientCodeStateManager.java
index 52795a0df7e..a8aa602442b 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/MemoryClientCodeStateManager.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/MemoryClientCodeStateManager.java
@@ -58,7 +58,7 @@ public class MemoryClientCodeStateManager implements 
ClientCodeStateManager {
                                                             
MultivaluedMap<String, String> redirectState) {
         String stateParam = redirectState.getFirst(OAuthConstants.STATE);
         String sessionToken = OAuthUtils.getSessionToken(mc, "state");
-        if (sessionToken == null || !sessionToken.equals(stateParam)) {
+        if (!OAuthUtils.compareTokens(sessionToken, stateParam)) {
             throw new OAuthServiceException("Invalid session token");
         }
         return map.remove(stateParam);
diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/DynamicRegistrationService.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/DynamicRegistrationService.java
index e5c09023760..e9b46b53692 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/DynamicRegistrationService.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/DynamicRegistrationService.java
@@ -76,7 +76,7 @@ public class DynamicRegistrationService {
     protected void checkInitialAuthentication() {
         if (initialAccessToken != null) {
             String accessToken = getRequestAccessToken();
-            if (!initialAccessToken.equals(accessToken)) {
+            if (!OAuthUtils.compareTokens(initialAccessToken, accessToken)) {
                 throw ExceptionUtils.toNotAuthorizedException(null, null);
             }
         } else {
@@ -105,7 +105,7 @@ public class DynamicRegistrationService {
     protected void checkRegistrationAccessToken(Client c, String accessToken) {
         String regAccessToken = 
c.getProperties().get(ClientRegistrationResponse.REG_ACCESS_TOKEN);
 
-        if (regAccessToken == null || !regAccessToken.equals(accessToken)) {
+        if (!OAuthUtils.compareTokens(regAccessToken, accessToken)) {
             throw ExceptionUtils.toNotAuthorizedException(null, null);
         }
     }
diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
index 307b46b3b76..b856d7c92e0 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
@@ -529,7 +529,7 @@ public abstract class RedirectionBasedGrantService extends 
AbstractOAuthService
         if (StringUtils.isEmpty(sessionToken)) {
             return false;
         }
-        return requestToken.equals(sessionToken);
+        return OAuthUtils.compareTokens(requestToken, sessionToken);
     }
 
     /**
diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java
index 9864791e8b6..cee0893b95d 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java
@@ -88,6 +88,13 @@ public final class OAuthUtils {
         }
     }
 
+    public static boolean compareTokens(String token1, String token2) {
+        if (token1 == null || token2 == null) {
+            return false;
+        }
+        return MessageDigest.isEqual(StringUtils.toBytesUTF8(token1), 
StringUtils.toBytesUTF8(token2));
+    }
+
     public static boolean compareCertificateThumbprints(X509Certificate cert, 
String encodedThumbprint) {
         try {
             byte[] thumbprint = createCertificateThumbprint(cert);