Permalink
Browse files

ruby 1.9 friendly secure_compare

Signed-off-by: Michael Koziarski <michael@koziarski.com>
  • Loading branch information...
1 parent d2cf33e commit 5de75398c495f109772b622291362a98bc6c21d1 @qoobaa qoobaa committed with NZKoz Sep 11, 2009
Showing with 6 additions and 9 deletions.
  1. +6 −9 activesupport/lib/active_support/message_verifier.rb
@@ -38,24 +38,21 @@ def generate(value)
end
private
- if "foo".respond_to?(:force_encoding)
+ if "foo".respond_to?(:bytesize)
# constant-time comparison algorithm to prevent timing attacks
+ # > 1.8.6 friendly version
def secure_compare(a, b)
- a = a.force_encoding(Encoding::BINARY)
- b = b.force_encoding(Encoding::BINARY)
-
- if a.length == b.length
+ if a.bytesize == b.bytesize
result = 0
- for i in 0..(a.length - 1)
- result |= a[i].ord ^ b[i].ord
- end
+ j = b.each_byte
+ a.each_byte { |i| result |= i ^ j.next }
result == 0
else
false
end
end
else
- # For 1.8
+ # For <= 1.8.6
def secure_compare(a, b)
if a.length == b.length
result = 0

0 comments on commit 5de7539

Please sign in to comment.