From c278c6af39de0ffde7e125481c674931826a3ab9 Mon Sep 17 00:00:00 2001 From: Hao Chen Date: Wed, 15 Jul 2026 14:53:27 +0800 Subject: [PATCH] fix(callback): validate upload callback secret (#3497) --- middleware/auth.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/middleware/auth.go b/middleware/auth.go index 8b51cc78..0653faeb 100644 --- a/middleware/auth.go +++ b/middleware/auth.go @@ -1,6 +1,7 @@ package middleware import ( + "crypto/subtle" "net/http" "github.com/cloudreve/Cloudreve/v4/application/dependency" @@ -204,6 +205,13 @@ func uploadCallbackCheck(c *gin.Context, policyType types.PolicyType) error { } callbackSession := callbackSessionRaw.(fs.UploadSession) + if subtle.ConstantTimeCompare( + []byte(callbackSession.CallbackSecret), + []byte(c.Param("key")), + ) != 1 { + return serializer.NewError(serializer.CodeCredentialInvalid, "Invalid callback secret", nil) + } + c.Set(manager.UploadSessionCtx, &callbackSession) if callbackSession.Policy.Type != string(policyType) { return serializer.NewError(serializer.CodePolicyNotAllowed, "", nil)