haskell/yesod
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use const time equality from byteable instead of crypto-api

Browse Source
This commit is contained in:
Vincent Hanquez 2014-03-18 08:29:47 +00:00
parent 43baddd1eb
commit 8d07d1fa72
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
yesod-form/Yesod/Form/Functions.hs
View File

@ -50,7 +50,7 @@ import Control.Arrow (second)
import Control.Monad.Trans.RWS (ask, get, put, runRWST, tell, evalRWST, local) import Control.Monad.Trans.RWS (ask, get, put, runRWST, tell, evalRWST, local)
import Control.Monad.Trans.Class import Control.Monad.Trans.Class
import Control.Monad (liftM, join) import Control.Monad (liftM, join)
import Crypto.Classes (constTimeEq) import Data.Byteable (constEqBytes)
import Text.Blaze (Markup, toMarkup) import Text.Blaze (Markup, toMarkup)
#define Html Markup #define Html Markup
#define toHtml toMarkup #define toHtml toMarkup
@ -223,7 +223,7 @@ postHelper form env = do
| not (Map.lookup tokenKey params === reqToken req) -> | not (Map.lookup tokenKey params === reqToken req) ->
FormFailure [renderMessage m langs MsgCsrfWarning] FormFailure [renderMessage m langs MsgCsrfWarning]
_ -> res _ -> res
where (Just [t1]) === (Just t2) = TE.encodeUtf8 t1 `constTimeEq` TE.encodeUtf8 t2 where (Just [t1]) === (Just t2) = TE.encodeUtf8 t1 `constEqBytes` TE.encodeUtf8 t2
Nothing === Nothing = True -- It's important to use constTimeEq Nothing === Nothing = True -- It's important to use constTimeEq
_ === _ = False -- in order to avoid timing attacks. _ === _ = False -- in order to avoid timing attacks.
return ((res', xml), enctype) return ((res', xml), enctype)

2
yesod-form/yesod-form.cabal
View File

@ -35,7 +35,7 @@ library
, blaze-html >= 0.5 , blaze-html >= 0.5
, blaze-markup >= 0.5.1 , blaze-markup >= 0.5.1
, attoparsec >= 0.10 , attoparsec >= 0.10
, crypto-api >= 0.8 , byteable
, aeson , aeson
, resourcet , resourcet