diff options
author | Micah Lee <micah@micahflee.com> | 2017-05-30 14:50:58 -0700 |
---|---|---|
committer | Micah Lee <micah@micahflee.com> | 2017-05-30 14:50:58 -0700 |
commit | b5fe8b751920b827345dca2ef11240e14578783c (patch) | |
tree | 00f8fd992e3097fe14a7ce5fb5d903b424075cfe | |
parent | baae8fada620ff73c2d0c212fd27c8838461c529 (diff) | |
parent | cd5d95a75de0a18b8c54e08b1012587392eb0e9a (diff) | |
download | onionshare-b5fe8b751920b827345dca2ef11240e14578783c.tar.gz onionshare-b5fe8b751920b827345dca2ef11240e14578783c.zip |
Merge branch 'delirious-lettuce-hmac_compare_digest'
-rw-r--r-- | onionshare/common.py | 20 | ||||
-rw-r--r-- | onionshare/web.py | 4 |
2 files changed, 2 insertions, 22 deletions
diff --git a/onionshare/common.py b/onionshare/common.py index e5aab895..89d4695f 100644 --- a/onionshare/common.py +++ b/onionshare/common.py @@ -114,26 +114,6 @@ def get_version(): return version -def constant_time_compare(val1, val2): - """ - Returns True if the two strings are equal, False otherwise. - - The time taken is independent of the number of characters that match. - - For the sake of simplicity, this function executes in constant time only - when the two strings have the same length. It short-circuits when they - have different lengths. - - From: http://www.levigross.com/2014/02/07/constant-time-comparison-functions-in...-python-haskell-clojure-and-java/ - """ - if len(val1) != len(val2): - return False - result = 0 - for x, y in zip(val1, val2): - result |= x ^ y - return result == 0 - - def random_string(num_bytes, output_len=None): """ Returns a random string with a specified number of bytes. diff --git a/onionshare/web.py b/onionshare/web.py index de5b0d2f..aec86bf4 100644 --- a/onionshare/web.py +++ b/onionshare/web.py @@ -18,7 +18,7 @@ You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>. """ from distutils.version import StrictVersion as Version -import queue, mimetypes, platform, os, sys, socket, logging +import queue, mimetypes, platform, os, sys, socket, logging, hmac from urllib.request import urlopen from flask import Flask, Response, request, render_template_string, abort, make_response @@ -162,7 +162,7 @@ def check_slug_candidate(slug_candidate, slug_compare = None): global slug if not slug_compare: slug_compare = slug - if not common.constant_time_compare(slug_compare.encode('ascii'), slug_candidate.encode('ascii')): + if not hmac.compare_digest(slug_compare, slug_candidate): abort(404) |