ey-hmac 0.0.3 → 0.0.4

data/lib/ey-hmac/adapter.rb

@@ -112,7 +112,8 @@ class Ey::Hmac::Adapter
       signature_value = authorization_match[2]
 
       if key_secret = block.call(key_id)
-        if signature_value == (calculated_signature = signature(key_secret))
+        calculated_signature = signature(key_secret)
+        if secure_compare(signature_value, calculated_signature)
         else raise(Ey::Hmac::SignatureMismatch, "Calculated siganature #{signature_value} does not match #{calculated_signature} using #{canonicalize.inspect}")
         end
       else raise(Ey::Hmac::MissingSecret, "Failed to find secret matching #{key_id.inspect}")
@@ -123,4 +124,16 @@ class Ey::Hmac::Adapter
     true
   end
   alias authenticate! authenticated!
+
+  # Constant time string comparison.
+  # pulled from https://github.com/rack/rack/blob/master/lib/rack/utils.rb#L399
+  def secure_compare(a, b)
+    return false unless a.bytesize == b.bytesize
+
+    l = a.unpack("C*")
+
+    r, i = 0, -1
+    b.each_byte { |v| r |= v ^ l[i+=1] }
+    r == 0
+  end
 end

data/lib/ey-hmac/version.rb

@@ -1,5 +1,5 @@
 module Ey
   module Hmac
-    VERSION = "0.0.3"
+    VERSION = "0.0.4"
   end
 end

metadata

@@ -1,15 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: ey-hmac
 version: !ruby/object:Gem::Version
+  version: 0.0.4
   prerelease: 
-  version: 0.0.3
 platform: ruby
 authors:
 - Josh Lane & Jason Hansen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-06 00:00:00.000000000 Z
+date: 2013-02-08 00:00:00.000000000 Z
 dependencies: []
 description: Lightweight HMAC signing libraries and middleware for Farday and Rack
 email: