mirror of
https://github.com/esphome/esphome.git
synced 2026-09-14 08:38:39 +00:00
J. Nick Koston
f2e1c2c650
- Use auth.value().size() instead of strlen() to avoid rescanning attacker-controlled header content. - Iterate over digest_len (expected length) instead of max_len so a long Authorization header cannot force extra work. The full-width length XOR already rejects any length mismatch.
