make sure input-as-buffer is same length as expected buffer before co…

…mparing. fixes #40
tj · Feb 17, 2022 · ea03dd5 · ea03dd5
1 parent 2e896ce
commit ea03dd5
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/index.js b/index.js
@@ -39,8 +39,9 @@ exports.unsign = function(input, secret){
   var tentativeValue = input.slice(0, input.lastIndexOf('.')),
       expectedInput = exports.sign(tentativeValue, secret),
       expectedBuffer = Buffer.from(expectedInput),
-      inputBuffer = Buffer.alloc(expectedBuffer.length);
-
-  inputBuffer.write(input);
-  return crypto.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
+      inputBuffer = Buffer.from(input);
+  return (
+    expectedBuffer.length === inputBuffer.length &&
+    crypto.timingSafeEqual(expectedBuffer, inputBuffer)
+   ) ? tentativeValue : false;
 };