Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-07-19 09:35:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use MessageDigest.isEqual() where possible

Browse Source 
fixes #7058
This commit is contained in:
Lars Grefer
2019-07-03 00:23:33 +02:00
committed by Josh Cummings
parent cd54808718
commit 4b0fb19fff
7 changed files with 17 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java
+1 -8
View File
@@ -256,15 +256,8 @@ public class TokenBasedRememberMeServices extends AbstractRememberMeServices {
private static boolean equals(String expected, String actual) {
byte[] expectedBytes = bytesUtf8(expected);
byte[] actualBytes = bytesUtf8(actual);
if (expectedBytes.length != actualBytes.length) {
return false;
}
int result = 0;
for (int i = 0; i < expectedBytes.length; i++) {
result |= expectedBytes[i] ^ actualBytes[i];
}
return result == 0;
return MessageDigest.isEqual(expectedBytes, actualBytes);
}
private static byte[] bytesUtf8(String s) {