mirror of
https://github.com/esphome/esphome.git
synced 2026-03-02 18:58:20 -07:00
f2e1c2c650
- Use auth.value().size() instead of strlen() to avoid rescanning attacker-controlled header content. - Iterate over digest_len (expected length) instead of max_len so a long Authorization header cannot force extra work. The full-width length XOR already rejects any length mismatch.
