(cxf) branch 4.1.x-fixes updated: compare pkce code verifier and client secret hash in constant time (#3170)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/4.1.x-fixes by this push:
     new f66e737a6ab compare pkce code verifier and client secret hash in 
constant time (#3170)
f66e737a6ab is described below

commit f66e737a6abba8d13001d6da4ca45b4fe88eb2d6
Author: Javid Khan <dxbja...@gmail.com>
AuthorDate: Wed Jun 3 18:52:36 2026 +0530

    compare pkce code verifier and client secret hash in constant time (#3170)
    
    * compare pkce code verifier and client secret hash in constant time
    
    * use OAuthUtils.compareTokens for the constant-time comparisons
    
    (cherry picked from commit 8574198baa814a84cb45ecbeaab7aede8978b774)
---
 .../rs/security/oauth2/grants/code/AuthorizationCodeGrantHandler.java  | 2 +-
 .../cxf/rs/security/oauth2/provider/ClientSecretHashVerifier.java      | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/AuthorizationCodeGrantHandler.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/AuthorizationCodeGrantHandler.java
index 992f516af11..cd79216b8a1 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/AuthorizationCodeGrantHandler.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/AuthorizationCodeGrantHandler.java
@@ -183,7 +183,7 @@ public class AuthorizationCodeGrantHandler extends 
AbstractGrantHandler {
                 codeVerifierTransformer = defaultCodeVerifierTransformer;
             }
             String transformedCodeVerifier = 
codeVerifierTransformer.transformCodeVerifier(clientCodeVerifier);
-            return clientCodeChallenge.equals(transformedCodeVerifier);
+            return OAuthUtils.compareTokens(clientCodeChallenge, 
transformedCodeVerifier);
         }
     }
 
diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/ClientSecretHashVerifier.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/ClientSecretHashVerifier.java
index f37cbed6501..9c8cd76aeb0 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/ClientSecretHashVerifier.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/ClientSecretHashVerifier.java
@@ -21,6 +21,7 @@ package org.apache.cxf.rs.security.oauth2.provider;
 
 import org.apache.cxf.common.util.StringUtils;
 import org.apache.cxf.rs.security.oauth2.common.Client;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
 import org.apache.cxf.rt.security.crypto.MessageDigestUtils;
 
 /**
@@ -31,7 +32,7 @@ public class ClientSecretHashVerifier implements 
ClientSecretVerifier {
     public boolean validateClientSecret(Client client, String clientSecret) {
         String hash = 
MessageDigestUtils.generate(StringUtils.toBytesUTF8(clientSecret),
                                                   hashAlgorithm);
-        return hash.equals(client.getClientSecret());
+        return OAuthUtils.compareTokens(hash, client.getClientSecret());
     }
     public void setHashAlgorithm(String hashAlgorithm) {
         this.hashAlgorithm = hashAlgorithm;