dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1321 from ShySec/master

Browse Source 
fixed timing attack in gluon.utils.compare
This commit is contained in:
mdipierro
2016-05-09 00:04:39 -05:00
parent 8666f993d1 292af5adc6
commit 54b0feeffb
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gluon/utils.py
+3 -5
View File
@@ -83,11 +83,9 @@ def compare(a, b):
""" Compares two strings and not vulnerable to timing attacks """ """ Compares two strings and not vulnerable to timing attacks """
if HAVE_COMPARE_DIGEST: if HAVE_COMPARE_DIGEST:
return hmac.compare_digest(a, b) return hmac.compare_digest(a, b)
if len(a) != len(b): result = len(a) ^ len(b)
return False for i in xrange(len(b)):
result = 0 result |= ord(a[i%len(a)]) ^ ord(b[i])
for x, y in zip(a, b):
result |= ord(x) ^ ord(y)
return result == 0 return result == 0