From 332395dc7ad9574a5959d72d812fbcb3ea5343d5 Mon Sep 17 00:00:00 2001
From: matteobaccan <200925+matteobaccan@users.noreply.github.com>
Date: Sun, 4 Oct 2026 07:18:51 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20timin?=
 =?UTF-8?q?g=20side-channel=20in=20RsaHandler.equals?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use MessageDigest.isEqual instead of Arrays.equals for fingerprint
comparison in RsaHandler.equals to prevent timing side-channel attacks.
---
 owner/src/main/java/org/aeonbits/owner/handlers/RsaHandler.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/owner/src/main/java/org/aeonbits/owner/handlers/RsaHandler.java b/owner/src/main/java/org/aeonbits/owner/handlers/RsaHandler.java
index eaa97a82..10fab2f5 100644
--- a/owner/src/main/java/org/aeonbits/owner/handlers/RsaHandler.java
+++ b/owner/src/main/java/org/aeonbits/owner/handlers/RsaHandler.java
@@ -574,7 +574,7 @@ public boolean equals(Object other) {
         if (this == other) return true;
         if (other == null || getClass() != other.getClass()) return false;
         RsaHandler that = (RsaHandler) other;
-        return name.equals(that.name) && java.util.Arrays.equals(fingerprint, that.fingerprint);
+        return name.equals(that.name) && MessageDigest.isEqual(fingerprint, that.fingerprint);
     }
 
     @Override