access_token 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 155a28989f2b3d9d182d2355225eb9e5f11136cb
-  data.tar.gz: d5d48fa77a2e3efb863f5c7c38ad32177c727fad
+  metadata.gz: e246af0e94a0d8c7632d4370f5a117fce1e469bb
+  data.tar.gz: b83d79d4804ec42c9f40e4c5b66620637c7677d3
 SHA512:
-  metadata.gz: 89b733cafcff734e853b3e26f44323db5eb1fe68337cb7ec192cdf896950cc85657d7a4d72367e02b30486a4b74b9cc5667de5a230f62e3b599a2ec0c713cea0
-  data.tar.gz: de4ee7a175851ef2ca3c0818b23106d77153a58332f7ae95f58292abfb04cc83a193d0cf6bc30dacc8b260f2cf2ea069441f1daf229b1b1ca2b8ad8902a12dca
+  metadata.gz: 251de5820ba056112f3ab9f8c25da1aaefb6bf6f87c33cb5c7c1dee58019aec4eb6aab3d7556758774d4ffed68ae4a68029a0c8b1f341262517e49bd3b02aaac
+  data.tar.gz: 5b295898302875abc0d2f0dd4d7160b8ff4506df015f90085aa800ef2482fe9709d87e2c4e47cca3ea14d9351111248b4f7110db74b35376e1d37de91128cce2

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+#### v0.1.2 — unreleased
+
+- Add secure comparison to avoid timing attack.
+
+#### v0.1.1 - Sep 13, 2015
+
+- Replace multiple Redis command calls (multi + set + expires) for just one (setex).
+
 #### v0.1.0 - May 31, 2015
 
 - Initial release

data/lib/access_token.rb

@@ -69,7 +69,7 @@ class AccessToken
 
     return unless data
     return unless fresh?(data[TIME_KEY])
-    return unless request_signature == data[SIGNATURE_KEY]
+    return unless secure_compare?(request_signature, data[SIGNATURE_KEY])
 
     data[ID_KEY]
   end
@@ -81,4 +81,13 @@ class AccessToken
   def fresh?(timestamp)
     timestamp > Time.now.to_i - ttl
   end
+
+  def secure_compare?(a, b)
+     return false if a.blank? || b.blank? || a.bytesize != b.bytesize
+     l = a.unpack "C#{a.bytesize}"
+
+     res = 0
+     b.each_byte { |byte| res |= byte ^ l.shift }
+     res == 0
+  end
 end

data/lib/access_token/version.rb

@@ -1,3 +1,3 @@
 class AccessToken
-  VERSION = '0.1.1'
+  VERSION = '0.1.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: access_token
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Nando Vieira
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2015-09-13 00:00:00.000000000 Z
+date: 2015-12-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: parsel
@@ -317,3 +317,4 @@ signing_key:
 specification_version: 4
 summary: Access token for client-side and API authentication.
 test_files: []
+has_rdoc: