公开登录/注册邮箱验证码比较改为 SHA-256 后恒定时间 Compare，堵住未授权口的计时侧信道。metric 持平 8。

Result: {"status":"keep","total_issues":8,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":1,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":8,"eslint_problems":0,"eslint_errors":0,"eslint_warnings":0,"tsc_errors":0,"measure_s":81,"golint_test_testifylint":0,"golint_test_thelper":0,"golint_test_usetesting":0,"golint_test_total":0,"golint_exhaustive":0,"golint_vetx_total":0,"vitest_failed":0,"vitest_total":126}

internal/apps/user/logics.go

@@ -6,6 +6,8 @@ package user
 import (
 	"context"
 	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -161,7 +163,9 @@ func verifyEmailCode(ctx context.Context, email, scene, code string) bool {
 	if err := db.GetJSON(ctx, codeKey, &storedCode); err != nil {
 		return false
 	}
-	if storedCode != code {
+	sumGot := sha256.Sum256([]byte(strings.TrimSpace(code)))
+	sumWant := sha256.Sum256([]byte(strings.TrimSpace(storedCode)))
+	if subtle.ConstantTimeCompare(sumGot[:], sumWant[:]) != 1 {
 		return false
 	}
 	_ = db.Redis.Del(ctx, db.PrefixedKey(codeKey)).Err()