Commit 7b28baf3 authored by Anthony Morris's avatar Anthony Morris
Browse files

Return false as early as possible

parent c5433ae2
......@@ -4,11 +4,15 @@ export default function safeCompare(stringA: string, stringB: string) {
const aLen = Buffer.byteLength(stringA);
const bLen = Buffer.byteLength(stringB);
if (aLen !== bLen) {
return false
}
// Turn strings into buffers with equal length
// to avoid leaking the length
const buffA = Buffer.alloc(aLen, 0, 'utf8');
buffA.write(stringA);
const buffB = Buffer.alloc(aLen, 0, 'utf8');
const buffB = Buffer.alloc(bLen, 0, 'utf8');
buffB.write(stringB);
return crypto.timingSafeEqual(buffA, buffB) && aLen === bLen;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment