dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use constant-time comparison to verify websocket hmac

Browse Source
This commit is contained in:
kelson
2016-08-17 16:18:44 -04:00
parent e87378b07f
commit b96d0697ee
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gluon/contrib/websocket_messaging.py
+7 -3
View File
@@ -93,6 +93,8 @@ import sys
import optparse import optparse
import time import time
import sys import sys
import gluon.utils
if (sys.version_info[0] == 2): if (sys.version_info[0] == 2):
from urllib import urlencode, urlopen from urllib import urlencode, urlopen
def to_bytes(obj, charset='utf-8', errors='strict'): def to_bytes(obj, charset='utf-8', errors='strict'):
@@ -141,7 +143,8 @@ class PostHandler(tornado.web.RequestHandler):
print('%s:MESSAGE to %s:%s' % (time.time(), group, message)) print('%s:MESSAGE to %s:%s' % (time.time(), group, message))
if hmac_key: if hmac_key:
signature = self.request.arguments['signature'][0] signature = self.request.arguments['signature'][0]
if not to_bytes(hmac.new(to_bytes(hmac_key), to_bytes(message)).hexdigest()) == signature: actual_signature = hmac.new(to_bytes(hmac_key), to_bytes(message)).hexdigest()
if not gluon.utils.compare(to_native(signature), actual_signature):
self.send_error(401) self.send_error(401)
for client in listeners.get(group, []): for client in listeners.get(group, []):
client.write_message(message) client.write_message(message)
@@ -160,13 +163,14 @@ class TokenHandler(tornado.web.RequestHandler):
message = self.request.arguments['message'][0] message = self.request.arguments['message'][0]
if hmac_key: if hmac_key:
signature = self.request.arguments['signature'][0] signature = self.request.arguments['signature'][0]
if not to_bytes(hmac.new(to_bytes(hmac_key), to_bytes(message)).hexdigest()) == signature: actual_signature = hmac.new(to_bytes(hmac_key), to_bytes(message)).hexdigest()
if not gluon.utils.compare(to_native(signature), actual_signature):
self.send_error(401) self.send_error(401)
tokens[message] = None tokens[message] = None
class DistributeHandler(tornado.websocket.WebSocketHandler): class DistributeHandler(tornado.websocket.WebSocketHandler):
def check_origin(self, origin): def check_origin(self, origin):
return True return True