lib/gocardless/utils.rb
# Given two strings, compare them in constant time (for the length of the
# string). This can avoid timing attacks when used to compare signed
# parameters.
# Borrowed from ActiveSupport::MessageVerifier.
# https://github.com/rails/rails/blob/master/activesupport/lib/active_support/message_verifier.rb
#
# @param [String] the first string to compare
# @param [String] this second string to compare
# @return [Boolean] the result of the comparison
Given two strings, compare them in constant time (for the length of the
string). This can avoid timing attacks when used to compare signed
parameters.
Given two strings compare them in constant time ( for the length of the string ) . This can avoid timing attacks when used to compare signed parameters .
def secure_compare(a, b)
      return false unless a.bytesize == b.bytesize
      l = a.unpack("C#{a.bytesize}")
      res = 0
      b.each_byte { |byte| res |= byte ^ l.shift }
      res == 0
    end
def secure_compare ( a , b ) return false unless a . bytesize == b . bytesize l = a . unpack ( "C#{a.bytesize}" ) res = 0 b . each_byte { | byte | res |= byte ^ l . shift } res == 0 end
Given two strings, compare them in constant time (for the length of the
string).
Given two strings compare them in constant time ( for the length of the string ) .
the result of the comparison
the result of the comparison
Boolean
a
<not_specific>
b
<not_specific>
<not_specific>
this second string to compare
this second string to compare