@goodandready/dsh-messenger-gateway 0.3.22 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/lib/http.js CHANGED
@@ -1,3 +1,5 @@
1
+ import { timingSafeEqual } from 'node:crypto'
2
+
1
3
  export async function readBody(req) {
2
4
  const chunks = []
3
5
  for await (const chunk of req) chunks.push(chunk)
@@ -15,4 +17,13 @@ export function isTrustedSettingsRequest(req) {
15
17
  const host = String(req.headers?.host || '')
16
18
  if (!origin || !host) return false
17
19
  try { return new URL(origin).host === host } catch { return false }
18
- }
20
+ }
21
+
22
+ export function timingSafeCompare(a, b) {
23
+ if (typeof a !== 'string' || typeof b !== 'string') return false
24
+ const bufA = Buffer.from(a, 'utf8')
25
+ const bufB = Buffer.from(b, 'utf8')
26
+ if (bufA.length !== bufB.length) return false
27
+ return timingSafeEqual(bufA, bufB)
28
+ }
29
+