fix[faustwp]: (#2310) use hash_equals for secret key comparison (#2312)

Replace timing-vulnerable === comparisons with hash_equals() for the
shared secret key in rest_authorize_permission_callback(),
wpac_authorize_permission_callback(), and filter_introspection().
The codebase already uses hash_equals() for HMAC validation in
auth/functions.php — these three spots were missed.

Also sanitize the $_SERVER['HTTP_X_FAUST_SECRET'] superglobal with
wp_unslash() and sanitize_text_field() per WordPress coding standards
before passing to hash_equals().

Split out from #2312 per @josephfusco review feedback — the blockset
cleanup half moves to a separate PR so each half can be reviewed and
reverted independently.

Co-authored-by: latenighthackathon <latenighthackathon@users.noreply.github.com>

Author: latenighthackathon

.changeset/hash-equals-secret-comparison.md

@@ -0,0 +1,5 @@
+---
+"@faustwp/wordpress-plugin": patch
+---
+
+fix[faustwp]: use hash_equals() for constant-time secret key comparison in REST and GraphQL permission callbacks

plugins/faustwp/includes/graphql/callbacks.php

@@ -66,8 +66,9 @@ function filter_introspection( $value, $default_value, $option_name, $section_fi
 		return $value;
 	}
 
-	$secret_key = get_secret_key();
-	if ( $secret_key !== $_SERVER['HTTP_X_FAUST_SECRET'] ) {
+	$secret_key   = get_secret_key();
+	$faust_secret = sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FAUST_SECRET'] ) );
+	if ( ! hash_equals( $secret_key, $faust_secret ) ) {
 		return $value;
 	}
 

plugins/faustwp/includes/rest/callbacks.php

@@ -419,7 +419,7 @@ function rest_authorize_permission_callback( \WP_REST_Request $request ) {
 	$header_key = $request->get_header( 'x-faustwp-secret' );
 
 	if ( $secret_key && $header_key ) {
-		return $secret_key === $header_key;
+		return hash_equals( $secret_key, $header_key );
 	}
 
 	return false;
@@ -444,7 +444,7 @@ function wpac_authorize_permission_callback( \WP_REST_Request $request ) {
 	$header_key = $request->get_header( 'x-wpe-headless-secret' );
 
 	if ( $secret_key && $header_key ) {
-		return $secret_key === $header_key;
+		return hash_equals( $secret_key, $header_key );
 	}
 
 	return false;