more robust use of crypto.timingSafeEqual()

rvagg · rvagg · commit 672b5644b3aa · 2019-09-19T22:35:49.000+10:00
diff --git a/github-webhook-handler.js b/github-webhook-handler.js
@@ -56,7 +56,12 @@ function create (initOptions) {
   }
 
   function verify (signature, data) {
-    return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(sign(data)))
+    const sig = Buffer.from(signature)
+    const signed = Buffer.from(sign(data))
+    if (sig.length !== signed.length) {
+      return false
+    }
+    return crypto.timingSafeEqual(sig, signed)
   }
 
   function handler (req, res, callback) {

Original file line number	Diff line number	Diff line change
`@@ -56,7 +56,12 @@ function create (initOptions) {`
`56`	`56`	`}`
`57`	`57`
`58`	`58`	`function verify (signature, data) {`
`59`		`- return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(sign(data)))`
	`59`	`+ const sig = Buffer.from(signature)`
	`60`	`+ const signed = Buffer.from(sign(data))`
	`61`	`+ if (sig.length !== signed.length) {`
	`62`	`+ return false`
	`63`	`+ }`
	`64`	`+ return crypto.timingSafeEqual(sig, signed)`
`60`	`65`	`}`
`61`	`66`
`62`	`67`	`function handler (req, res, callback) {`