github/rails
1
1
Fork 0
mirror of https://github.com/github/rails.git synced 2026-04-26 03:00:59 -04:00
Code Issues Packages Projects Releases Wiki Activity

ruby 1.9 friendly secure_compare

Browse Source 
Signed-off-by: Michael Koziarski <michael@koziarski.com>
This commit is contained in:
Jakub Kuźma
2009-09-11 09:13:14 +02:00
committed by Michael Koziarski
parent ff2eb2d808
commit b22c951e7a
1 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
activesupport/lib/active_support/message_verifier.rb
View File

@@ -38,24 +38,21 @@ module ActiveSupport
end
private
if "foo".respond_to?(:force_encoding)
if "foo".respond_to?(:bytesize)
# constant-time comparison algorithm to prevent timing attacks
# > 1.8.6 friendly version
def secure_compare(a, b)
a = a.force_encoding(Encoding::BINARY)
b = b.force_encoding(Encoding::BINARY)
if a.length == b.length
if a.bytesize == b.bytesize
result = 0
for i in 0..(a.length - 1)
result |= a[i].ord ^ b[i].ord
end
j = b.each_byte
a.each_byte { |i| result |= i ^ j.next }
result == 0
else
false
end
end
else
# For 1.8
# For <= 1.8.6
def secure_compare(a, b)
if a.length == b.length
result = 0