php/yii2
1
0
Fork 0
mirror of https://github.com/yiisoft/yii2.git synced 2025-11-03 05:48:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Method Security::compareString() extracted

Browse Source
This commit is contained in:
Paul Klimov
2014-06-27 21:33:42 +03:00
parent 4a47a59323
commit 4768dcdbc2
2 changed files with 25 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
framework/base/Security.php
View File

@ -184,12 +184,11 @@ class Security extends Component
$calculatedHash = hash_hmac($algorithm, $pureData, $key);
// timing attack resistant approach:
$diff = 0;
for ($i = 0; $i < StringHelper::byteLength($calculatedHash); $i++) {
$diff |= (ord($calculatedHash[$i]) ^ ord($hash[$i]));
if ($this->compareString($hash, $calculatedHash)) {
return $pureData;
} else {
return false;
}
return $diff === 0 ? $pureData : false;
} else {
return false;
}
@ -322,14 +321,7 @@ class Security extends Component
return false;
}
// Use a for-loop to compare two strings to prevent timing attacks. See:
// http://codereview.stackexchange.com/questions/13512
$check = 0;
for ($i = 0; $i < $n; ++$i) {
$check |= (ord($test[$i]) ^ ord($hash[$i]));
}
return $check === 0;
return $this->compareString($test, $hash);
}
/**
@ -365,4 +357,21 @@ class Security extends Component
return $salt;
}
/**
* Performs string comparison using timing attack resistant approach.
* @see http://codereview.stackexchange.com/questions/13512
* @param string $expected string to compare.
* @param string $actual string to compare.
* @return boolean whether strings are equal.
*/
protected function compareString($expected, $actual)
{
// timing attack resistant approach:
$diff = 0;
for ($i = 0; $i < StringHelper::byteLength($actual); $i++) {
$diff |= (ord($actual[$i]) ^ ord($expected[$i]));
}
return $diff === 0;
}
}