mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
fa487763d9
to make it not leak length information even for variable length string.
Renamed old `ActiveSupport::SecurityUtils.secure_compare` to `fixed_length_secure_compare`,
and started raising `ArgumentError` in case of length mismatch of passed strings.
25 lines
1,012 B
Ruby
25 lines
1,012 B
Ruby
require "abstract_unit"
|
|
require "active_support/security_utils"
|
|
|
|
class SecurityUtilsTest < ActiveSupport::TestCase
|
|
def test_secure_compare_should_perform_string_comparison
|
|
assert ActiveSupport::SecurityUtils.secure_compare("a", "a")
|
|
assert_not ActiveSupport::SecurityUtils.secure_compare("a", "b")
|
|
end
|
|
|
|
def test_variable_size_secure_compare_should_perform_string_comparison
|
|
assert ActiveSupport::SecurityUtils.variable_size_secure_compare("a", "a")
|
|
assert_not ActiveSupport::SecurityUtils.variable_size_secure_compare("a", "b")
|
|
end
|
|
|
|
def test_fixed_length_secure_compare_should_perform_string_comparison
|
|
assert ActiveSupport::SecurityUtils.fixed_length_secure_compare("a", "a")
|
|
assert !ActiveSupport::SecurityUtils.fixed_length_secure_compare("a", "b")
|
|
end
|
|
|
|
def test_fixed_length_secure_compare_raise_on_length_mismatch
|
|
assert_raises(ArgumentError, "string length mismatch.") do
|
|
ActiveSupport::SecurityUtils.fixed_length_secure_compare("a", "ab")
|
|
end
|
|
end
|
|
end
|