diff options
| author | Jörg Thalheim <joerg@higgsboson.tk> | 2015-03-06 19:49:38 +0100 |
|---|---|---|
| committer | Jörg Thalheim <joerg@higgsboson.tk> | 2015-03-06 20:06:26 +0100 |
| commit | 9f089ac48c22b2f7cfbc7dd0ca29da924c566363 (patch) | |
| tree | a06b8860ae7233d70ab1c40955e702056647b2a2 /lib/api/files.rb | |
| parent | 0625d68f7510a2f2203bfe2c57f5927a0121c561 (diff) | |
| download | gitlab-ce-9f089ac48c22b2f7cfbc7dd0ca29da924c566363.tar.gz | |
use constant-time string compare for internal api authentication
Ruby str_equal uses memcmp internally to compare String.
Memcmp is vunerable to timing attacks because it returns early
on mismatch (on most x32 platforms memcmp uses a bytewise comparision).
Devise.secure_compare implements a constant time comparision instead.
Diffstat (limited to 'lib/api/files.rb')
0 files changed, 0 insertions, 0 deletions