Skip to content

Conversation

CasEbb
Copy link
Contributor

@CasEbb CasEbb commented Aug 21, 2025

This PR fixes a possible timing attack in Notification::verifyNotification().

The two hashes are compared using simple string comparison which is susceptible to timing attacks. It is replaced with the constant-time hash_equals() function.

@danielcivit
Copy link
Member

Hello @CasEbb

Thanks for submitting this contribution.

Replacing the direct string comparison with hash_equals() is a great security enhancement, as you explained, we understand it prevents potential timing attacks during hash verification.

We will be processing a new release soon that will include this change.

@danielcivit danielcivit self-requested a review August 21, 2025 11:05
@danielcivit danielcivit merged commit 78ea6d6 into MultiSafepay:master Aug 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants