server: adjust runner hook secret checking

Homebrew · Nov 2, 2023 · 75702b9 · 75702b9
1 parent e98388f
commit 75702b9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/server.rb b/src/server.rb
@@ -277,7 +277,7 @@ def verify_runner_hook(params)
     job = SharedState.instance.job(runner_name)
     return if job.nil?
 
-    if job.secret != params["orchestrator_secret"]
+    unless Rack::Utils.secure_compare(job.secret, params["orchestrator_secret"])
       $stderr.puts("Secret mismatch for #{runner_name}!")
       halt 403, "Forbidden."
     end