fix(security): use constant-time comparison for BlueBubbles webhook auth

[zapabob]

Summary

The BlueBubbles webhook handler authenticated inbound requests with a plain string inequality check against the configured shared password. A plain != comparison short-circuits on the first differing byte, so the time taken to reject a request correlates with how many leading bytes of the supplied credential matched. This is a classic timing side channel (CWE-208) that, over many requests, can let an attacker recover the secret byte-by-byte.

Root cause

gateway/platforms/bluebubbles.py — _handle_webhook:

python token = request.query.get(password) or ... or request.headers.get(x-bluebubbles-guid) if token != self.password: return web.json_response({error: unauthorized}, status=401)

Fix

Compare with hmac.compare_digest (constant-time). token may be None when no credential is supplied, so it is coerced to an empty string before encoding; unauthenticated requests are still rejected and no exception is raised.

Tests

tests/gateway/test_bluebubbles.py::TestBlueBubblesWebhookAuth — wrong credential rejected, missing credential rejected (no exception), and an invariant test asserting both operands flow through hmac.compare_digest (i.e. no plain == fast path remains). Full existing test_bluebubbles.py suite (59 tests) still passes.

Impact

Inbound webhook authentication only. No change to message handling, config, prompt cache, or role alternation. Behavior is identical for valid/invalid credentials apart from the comparison being constant-time.

[liuhao1024]

Verification: LGTM ✅

Reviewed the diff and tests. The webhook auth check correctly handles the None token case with (token or "").encode("utf-8") — a missing credential header/query param would otherwise cause a TypeError on .encode().

Checked:

• hmac.compare_digest used for constant-time comparison (CWE-208)
• None token coerced to empty string before encoding (prevents TypeError)
• Test covers: wrong password rejected, missing credential rejected, constant-time compare verified via spy
• The test_missing_credential_rejected test is important — it catches the None edge case that a plain != would silently handle but hmac.compare_digest would crash on

Clean implementation, no issues found.

[liuhao1024]

Verified: constant-time webhook auth is correctly implemented.

Reviewed the full diff — the fix replaces plain != with hmac.compare_digest(), coerces None tokens via (token or "").encode("utf-8"), and uses consistent UTF-8 encoding on both operands. Tests cover the three critical cases: wrong password, missing credential header, and verification that the constant-time comparator is actually invoked (spy pattern). Clean implementation.

Note: this is part of a cluster with #44026 (Slack SSRF guard) and #44027 (Google Meet constant-time token) — all three follow the same CWE-208 pattern and are independently clean.

[alt-glitch]

Duplicate of #9219 — same hmac.compare_digest constant-time fix for the BlueBubbles webhook token in the same file (gateway/platforms/bluebubbles.py).

[teknium1]

Thanks for the focused security hardening. The current-main premise is valid: gateway/platforms/bluebubbles.py:883 still uses token != self.password, and the proposed UTF-8 byte hmac.compare_digest replacement addresses that path.

Problems

• The added tests verify rejection and that the comparator is invoked, but do not verify a valid credential is accepted. Add a successful-auth assertion for _handle_webhook.
• Add non-ASCII credential coverage. The byte-based implementation supports it, and the related duplicate PR #9219 already demonstrates the useful correct/wrong credential cases.

Suggested changes

• Test a valid token returning 200 using a non-message webhook payload.
• Test a non-ASCII configured password with both matching and non-matching tokens.

Automated hermes-sweeper review.

[teknium1]

Please add a positive-auth regression case. These tests establish 401 behavior and comparator invocation, but none verifies that a request with the configured token proceeds to the normal 200 webhook path.