From 19514367adf2d9fe5be2b7666e397979ea679b94 Mon Sep 17 00:00:00 2001
From: Henrique Dias <mail@hacdias.com>
Date: Wed, 3 Jun 2026 12:21:23 +0200
Subject: [PATCH] fix: use constant-time comparison for share access token

Compare the share token with subtle.ConstantTimeCompare instead of ==.
---
 http/public.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/http/public.go b/http/public.go
index bf49927c..fb71d2b8 100644
--- a/http/public.go
+++ b/http/public.go
@@ -1,6 +1,7 @@
 package fbhttp
 
 import (
+	"crypto/subtle"
 	"errors"
 	"net/http"
 	"net/url"
@@ -136,7 +137,7 @@ func authenticateShareRequest(r *http.Request, l *share.Link) (int, error) {
 		return 0, nil
 	}
 
-	if r.URL.Query().Get("token") == l.Token {
+	if subtle.ConstantTimeCompare([]byte(r.URL.Query().Get("token")), []byte(l.Token)) == 1 {
 		return 0, nil
 	}