[fix][broker] Use MessageDigest.isEqual when comparing digests (#21061)

(cherry picked from commit c05954e)
apache · Aug 24, 2023 · 6274fa0 · 6274fa0
1 parent c644849
commit 6274fa0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/...-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java b/...-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java
@@ -76,7 +76,7 @@ public String verifyAndExtract(String signedStr) throws AuthenticationException
         String originalSignature = signedStr.substring(index + SIGNATURE.length());
         String rawValue = signedStr.substring(0, index);
         String currentSignature = computeSignature(rawValue);
-        if (!originalSignature.equals(currentSignature)) {
+        if (!MessageDigest.isEqual(originalSignature.getBytes(), currentSignature.getBytes())){
             throw new AuthenticationException("Invalid signature");
         }
         return rawValue;