From a759f9a0bd7f45db86bb9ffc336fa99d7b86a50d Mon Sep 17 00:00:00 2001 From: Ben Darnell Date: Sat, 29 Sep 2012 11:27:46 -0700 Subject: [PATCH] Python 3.3 includes a fast time-independent comparison function, so use it when available. --- tornado/web.py | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/tornado/web.py b/tornado/web.py index 21508e70e..68bf78b16 100644 --- a/tornado/web.py +++ b/tornado/web.py @@ -2047,17 +2047,20 @@ class URLSpec(object): url = URLSpec -def _time_independent_equals(a, b): - if len(a) != len(b): - return False - result = 0 - if type(a[0]) is int: # python3 byte strings - for x, y in zip(a, b): - result |= x ^ y - else: # python2 - for x, y in zip(a, b): - result |= ord(x) ^ ord(y) - return result == 0 +if hasattr(hmac, 'compare_digest'): # python 3.3 + _time_independent_equals = hmac.compare_digest +else: + def _time_independent_equals(a, b): + if len(a) != len(b): + return False + result = 0 + if type(a[0]) is int: # python3 byte strings + for x, y in zip(a, b): + result |= x ^ y + else: # python2 + for x, y in zip(a, b): + result |= ord(x) ^ ord(y) + return result == 0 def create_signed_value(secret, name, value): -- 2.47.2