@tokenoftrust/storefront-runner 2.4.62 → 2.4.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.62",
+  "version": "2.4.63",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -424,6 +424,18 @@ async function hmacHex(secret: string, message: string): Promise<string> {
     .join("");
 }
 
+function constantTimeHexEqual(expected: string, presented: string): boolean {
+  const enc = new TextEncoder();
+  const left = enc.encode(expected);
+  const right = enc.encode(presented);
+  const length = Math.max(left.length, right.length);
+  let acc = left.length ^ right.length;
+  for (let i = 0; i < length; i++) {
+    acc |= (left[i] ?? 0) ^ (right[i] ?? 0);
+  }
+  return acc === 0;
+}
+
 /**
  * Sign one field for product `code`. Editable fields hash the sentinel
  * `--OPEN--` and gain the `||open` suffix so checkout accepts a user-entered value.
@@ -596,7 +608,7 @@ export async function enforceCartSubmission(input: {
     if (!field.hash) return false;
     const valueToHash = field.open ? "--OPEN--" : field.value;
     const expected = await hmacHex(secret, codeField.value + field.baseName + valueToHash);
-    return expected === field.hash;
+    return constantTimeHexEqual(expected, field.hash);
   };
 
   if (signed) {