diff options
| -rw-r--r-- | activesupport/lib/active_support/message_verifier.rb | 36 |
1 files changed, 27 insertions, 9 deletions
diff --git a/activesupport/lib/active_support/message_verifier.rb b/activesupport/lib/active_support/message_verifier.rb index aae5a3416d..8d14423d91 100644 --- a/activesupport/lib/active_support/message_verifier.rb +++ b/activesupport/lib/active_support/message_verifier.rb @@ -38,16 +38,34 @@ module ActiveSupport end private - # constant-time comparison algorithm to prevent timing attacks - def secure_compare(a, b) - if a.length == b.length - result = 0 - for i in 0..(a.length - 1) - result |= a[i] ^ b[i] + if "foo".respond_to?(:force_encoding) + # constant-time comparison algorithm to prevent timing attacks + def secure_compare(a, b) + a = a.force_encoding(Encoding::BINARY) + b = b.force_encoding(Encoding::BINARY) + + if a.length == b.length + result = 0 + for i in 0..(a.length - 1) + result |= a[i].ord ^ b[i].ord + end + result == 0 + else + false + end + end + else + # For 1.8 + def secure_compare(a, b) + if a.length == b.length + result = 0 + for i in 0..(a.length - 1) + result |= a[i] ^ b[i] + end + result == 0 + else + false end - result == 0 - else - false end end |