Token validation in GitlabWebController using hmac comparison

== on strings short-circuits at the first differing byte, so comparison
time leaks how many leading characters of the attacker's guess are
correct. Since the incoming x-gitlab-token header is fully
attacker-controlled and the endpoint is unauthenticated, that timing
signal makes the configured webhook token recoverable byte-by-byte over
many requests. compare_digest is constant-time for equal-length inputs
and doesn't leak position of the mismatch, which is the standard fix for
secret comparison — the same treatment GitHub/Gitea drivers give their
webhook signatures.

Change-Id: Iafcc1286977080e91b9b2f15994d1d3ced586309

zuul/driver/gitlab/gitlabconnection.py

@@ -23,6 +23,7 @@ import uuid
 import re
 import requests
 import urllib3
+import hmac
 
 import dateutil.parser
 
@@ -906,7 +907,7 @@ class GitlabWebController(BaseWebController):
             raise cherrypy.HTTPError(401, 'x-gitlab-token header missing.')
 
         configured_token = self.connection.webhook_token
-        if not configured_token == event_token:
+        if not hmac.compare_digest(str(event_token), str(configured_token)):
             self.log.debug(
                 "Missmatch (Incoming token: %s, Configured token: %s)" % (
                     event_token, configured_token))