Remove `constant_time_compare` to use `hmac.compare_digest`

2 files changed, 2 insertions, 22 deletions

diff --git a/onionshare/common.py b/onionshare/common.py
index 508acd36..37dde31c 100644
--- a/onionshare/common.py
+++ b/onionshare/common.py
@@ -99,26 +99,6 @@ def get_version():
         return version
 
 
-def constant_time_compare(val1, val2):
-    """
-    Returns True if the two strings are equal, False otherwise.
-
-    The time taken is independent of the number of characters that match.
-
-    For the sake of simplicity, this function executes in constant time only
-    when the two strings have the same length. It short-circuits when they
-    have different lengths.
-
-    From: http://www.levigross.com/2014/02/07/constant-time-comparison-functions-in...-python-haskell-clojure-and-java/
-    """
-    if len(val1) != len(val2):
-        return False
-    result = 0
-    for x, y in zip(val1, val2):
-        result |= x ^ y
-    return result == 0
-
-
 def random_string(num_bytes, output_len=None):
     """
     Returns a random string with a specified number of bytes.
diff --git a/onionshare/web.py b/onionshare/web.py
index de5b0d2f..aec86bf4 100644
--- a/onionshare/web.py
+++ b/onionshare/web.py
@@ -18,7 +18,7 @@ You should have received a copy of the GNU General Public License
 along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """
 from distutils.version import StrictVersion as Version
-import queue, mimetypes, platform, os, sys, socket, logging
+import queue, mimetypes, platform, os, sys, socket, logging, hmac
 from urllib.request import urlopen
 
 from flask import Flask, Response, request, render_template_string, abort, make_response
@@ -162,7 +162,7 @@ def check_slug_candidate(slug_candidate, slug_compare = None):
     global slug
     if not slug_compare:
         slug_compare = slug
-    if not common.constant_time_compare(slug_compare.encode('ascii'), slug_candidate.encode('ascii')):
+    if not hmac.compare_digest(slug_compare, slug_candidate):
         abort(404)