mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
21 lines
585 B
Ruby
21 lines
585 B
Ruby
|
module ActiveSupport
|
||
|
|
module SecurityUtils
|
||
|
|
# Constant time string comparison.
|
||
|
|
#
|
||
|
|
# The values compared should be of fixed length, such as strings
|
||
|
|
# that have already been processed by HMAC. This should not be used
|
||
|
|
# on variable length plaintext strings because it could leak length info
|
||
|
|
# via timing attacks.
|
||
|
|
def secure_compare(a, b)
|
||
|
|
return false unless a.bytesize == b.bytesize
|
||
|
|
|
||
|
|
l = a.unpack "C#{a.bytesize}"
|
||
|
|
|
||
|
|
res = 0
|
||
|
|
b.each_byte { |byte| res |= byte ^ l.shift }
|
||
|
|
res == 0
|
||
|
|
end
|
||
|
|
module_function :secure_compare
|
||
|
|
end
|
||
|
|
end
|