diff options
author | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-25 11:25:11 -0800 |
---|---|---|
committer | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-25 11:25:11 -0800 |
commit | 6dfab475ca230dfcad7a603483431c8e7a8f908e (patch) | |
tree | 69ca8ade43b0e39e1d8cffa68390e9052e589acf /activesupport/lib/active_support/security_utils.rb | |
parent | 14e92bac1a4c199e5e8936c6bdc64420293ea6d1 (diff) | |
parent | 908c011395cc9e3ea1bb195f9d1bd30a9d9df98f (diff) | |
download | rails-6dfab475ca230dfcad7a603483431c8e7a8f908e.tar.gz rails-6dfab475ca230dfcad7a603483431c8e7a8f908e.tar.bz2 rails-6dfab475ca230dfcad7a603483431c8e7a8f908e.zip |
Merge branch '5-0-beta-sec'
* 5-0-beta-sec:
bumping version
fix version update task to deal with .beta1.1
Eliminate instance level writers for class accessors
allow :file to be outside rails root, but anything else must be inside the rails view directory
Don't short-circuit reject_if proc
stop caching mime types globally
use secure string comparisons for basic auth username / password
Diffstat (limited to 'activesupport/lib/active_support/security_utils.rb')
-rw-r--r-- | activesupport/lib/active_support/security_utils.rb | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/activesupport/lib/active_support/security_utils.rb b/activesupport/lib/active_support/security_utils.rb index 64c4801179..9be8613ada 100644 --- a/activesupport/lib/active_support/security_utils.rb +++ b/activesupport/lib/active_support/security_utils.rb @@ -1,3 +1,5 @@ +require 'digest' + module ActiveSupport module SecurityUtils # Constant time string comparison. @@ -16,5 +18,10 @@ module ActiveSupport res == 0 end module_function :secure_compare + + def variable_size_secure_compare(a, b) # :nodoc: + secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b)) + end + module_function :variable_size_secure_compare end end |