@@ -40,14 +40,27 @@ module ActiveSupport private # constant-time comparison algorithm to prevent timing attacks def secure_compare(a, b) - if a.length == b.length - result = 0 - for i in 0..(a.length - 1) - result |= a[i] ^ b[i] + if a.respond_to?(:bytesize) + # > 1.8.6 friendly version + if a.bytesize == b.bytesize + result = 0 + j = b.each_byte + a.each_byte { |i| result |= i ^ j.next } + result == 0 + else + false end - result == 0 else - false + # <= 1.8.6 friendly version + if a.size == b.size + result = 0 + for i in 0..(a.length - 1) + result |= a[i] ^ b[i] + end + result == 0 + else + false + end end end vendor/rails/activesupport/lib/active_support/message_verifier.rb 7606ecd8c875945aa06983d29044d1ac6bb371c6 Kenneth Kalmer kenneth.kalmer@gmail.com http://github.com/kennethkalmer/powerdns-on-rails/commit/5fa7d74518545c3b1c5ec15b7a527d1500c1b477 5fa7d74518545c3b1c5ec15b7a527d1500c1b477 2009-09-29T17:04:59-07:00 2009-09-29T17:04:59-07:00 1.9 compat for Rails 2.3.4 4c84707483159ece9a757c1cb1b31e92713dc089 Kenneth Kalmer kenneth.kalmer@gmail.com