diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2009-09-13 00:32:30 -0700 |
|---|---|---|
| committer | Jeremy Kemper <jeremy@bitsweat.net> | 2009-09-13 02:44:52 -0700 |
| commit | f959758687b63e8f5366b315cc4845c2bbd5f6e8 (patch) | |
| tree | 780fa1dc247de5faf55bc89bbfe06df6b66f188d | |
| parent | e590508a9b7ab5cf99d7a7675a92a1257cb9f6f8 (diff) | |
| download | rails-f959758687b63e8f5366b315cc4845c2bbd5f6e8.tar.gz rails-f959758687b63e8f5366b315cc4845c2bbd5f6e8.tar.bz2 rails-f959758687b63e8f5366b315cc4845c2bbd5f6e8.zip | |
making secure_compare faster
[#3195 state:committed]
Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net>
| -rw-r--r-- | activesupport/lib/active_support/message_verifier.rb | 36 |
1 files changed, 8 insertions, 28 deletions
diff --git a/activesupport/lib/active_support/message_verifier.rb b/activesupport/lib/active_support/message_verifier.rb index 3e72100bd9..a6723b8b33 100644 --- a/activesupport/lib/active_support/message_verifier.rb +++ b/activesupport/lib/active_support/message_verifier.rb @@ -38,35 +38,15 @@ module ActiveSupport end private - if "foo".respond_to?(:force_encoding) - # constant-time comparison algorithm to prevent timing attacks - def secure_compare(a, b) - a = a.dup.force_encoding(Encoding::BINARY) - b = b.dup.force_encoding(Encoding::BINARY) + # constant-time comparison algorithm to prevent timing attacks + def secure_compare(a, b) + return false unless a.bytesize == b.bytesize - if a.length == b.length - result = 0 - for i in 0..(a.length - 1) - result |= a[i].ord ^ b[i].ord - end - result == 0 - else - false - end - end - else - # For 1.8 - def secure_compare(a, b) - if a.length == b.length - result = 0 - for i in 0..(a.length - 1) - result |= a[i] ^ b[i] - end - result == 0 - else - false - end - end + l = a.unpack "C#{a.bytesize}" + + res = 0 + b.each_byte { |b| res |= b ^ l.shift } + res == 0 end def generate_digest(data) |