Gandalf/sofarr
Public Access
0
0
Fork 0
Code Issues 1 Pull Requests Actions 1 Packages Projects Releases 59 Wiki Activity

BUG: Uncaught TypeError Crash in CSRF Verification Middleware #31

New Issue
Closed
opened 2026-05-22 15:40:02 +01:00 by Gandalf · 1 comment
Gandalf commented 2026-05-22 15:40:02 +01:00
Owner
Copy Link
Copy Source

verifyCsrf.js compares cookieToken.length !== headerToken.length at character-level. If multi-byte tokens are sent where string length matches but byte length differs, Buffer.from() yields differing lengths. Consequently, crypto.timingSafeEqual throws an unhandled TypeError crash (500) rather than a clean 403.

verifyCsrf.js compares cookieToken.length !== headerToken.length at character-level. If multi-byte tokens are sent where string length matches but byte length differs, Buffer.from() yields differing lengths. Consequently, crypto.timingSafeEqual throws an unhandled TypeError crash (500) rather than a clean 403.
Gandalf added the Kind/Bug label 2026-05-22 15:40:55 +01:00
Gandalf commented 2026-05-22 16:00:53 +01:00
Author
Owner
Copy Link
Copy Source

Resolution: Refactored server/middleware/verifyCsrf.js to instantiate byte buffers from tokens first, and then perform a timing-safe length verification on the buffers (a.length !== b.length) before running crypto.timingSafeEqual(). This prevents uncaught Node.js TypeErrors and handles multi-byte tokens gracefully. Added unit tests in tests/unit/verifyCsrf.test.js.

Resolution: Refactored server/middleware/verifyCsrf.js to instantiate byte buffers from tokens first, and then perform a timing-safe length verification on the buffers (a.length !== b.length) before running crypto.timingSafeEqual(). This prevents uncaught Node.js TypeErrors and handles multi-byte tokens gracefully. Added unit tests in tests/unit/verifyCsrf.test.js.
Gandalf added the Area/Frontend label 2026-05-28 11:53:58 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Area/Docker
Docker image and container packaging
 Area/Download Clients
Download client integrations
 Area/Frontend
Client-side UI and build tooling
 Area/History
History and completed downloads views
 Area/Logging
Log streaming, file handling, and debug infrastructure
 Area/Matching
Matching and correlation logic
 Area/Proxy
Upstream service proxy routes
 Area/SSE
Server-Sent Events and real-time streaming
 Area/Webhooks
Webhook processing and reliability
 Compat/Breaking
Breaking change that won't be backward compatible
 Compat/Non-Breaking
Non-breaking compatibility change
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label Area/Frontend Kind/Bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Gandalf
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Gandalf/sofarr#31
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?