ruby 1.9 friendly secure_compare

Signed-off-by: Michael Koziarski <michael@koziarski.com>
rails · Sep 12, 2009 · b22c951 · b22c951 · rubys · Sep 12, 2009
1 parent ff2eb2d
commit b22c951
Showing 1 changed file with 6 additions and 9 deletions.
diff --git a/activesupport/lib/active_support/message_verifier.rb b/activesupport/lib/active_support/message_verifier.rb
@@ -38,24 +38,21 @@ def generate(value)
     end
 
     private
-      if "foo".respond_to?(:force_encoding)
+      if "foo".respond_to?(:bytesize)
         # constant-time comparison algorithm to prevent timing attacks
+        # > 1.8.6 friendly version
         def secure_compare(a, b)
-          a = a.force_encoding(Encoding::BINARY)
-          b = b.force_encoding(Encoding::BINARY)
-
-          if a.length == b.length
+          if a.bytesize == b.bytesize
             result = 0
-            for i in 0..(a.length - 1)
-              result |= a[i].ord ^ b[i].ord
-            end
+            j = b.each_byte
+            a.each_byte { |i| result |= i ^ j.next }
             result == 0
           else
             false
           end
         end
       else
-        # For 1.8
+        # For <= 1.8.6
         def secure_compare(a, b)
           if a.length == b.length
             result = 0