Module: Bayarcash::SecurityUtils

Defined in:
lib/bayarcash/security_utils.rb

Overview

Constant-time string comparison helpers, mirroring PHP's hash_equals.

This is the Ruby equivalent of Rack::Utils.secure_compare / ActiveSupport::SecurityUtils.secure_compare and is used to compare callback checksums so that verification is not vulnerable to timing attacks.

Class Method Summary collapse

Class Method Details

.secure_compare(left, right) ⇒ Boolean

Compare two strings in (length-dependent but content-) constant time.

Parameters:

  • left (String)
  • right (String)

Returns:

  • (Boolean) —

    true only when the two strings are byte-for-byte equal



17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
 
# File 'lib/bayarcash/security_utils.rb', line 17

def secure_compare(left, right)
  left = left.to_s
  right = right.to_s

  return false unless left.bytesize == right.bytesize

  if OpenSSL.respond_to?(:fixed_length_secure_compare)
    begin
      return OpenSSL.fixed_length_secure_compare(left, right)
    rescue StandardError
      # fall through to the manual implementation
    end
  end

  l = left.unpack("C*")
  res = 0
  right.each_byte { |byte| res |= byte ^ l.shift }
  res.zero?
end