🚑️ [SECURITY] Fix unsafe string comparison

pboling · pboling · commit 98398860519e · 2021-11-01T02:22:14.000+07:00
- Closes #156 Signed-off-by: Peter Boling <peter.boling@gmail.com>
diff --git a/lib/oauth/signature/base.rb b/lib/oauth/signature/base.rb
@@ -51,7 +51,9 @@ def signature
     end
 
     def ==(cmp_signature)
-      signature == cmp_signature
+      check = signature.bytesize ^ cmp_signature.bytesize
+      signature.bytes.zip(cmp_signature.bytes) { |x, y| check |= x ^ y.to_i }
+      check.zero?
     end
 
     def verify
