diogo
/
symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

prevent timing attacks in digest auth listener

This commit is contained in:
Christian Flothmann 2015-11-10 16:51:36 +01:00 committed by Fabien Potencier
parent 557ea17eeb
commit 819aa54fe4
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider.php
View File

@ -66,7 +66,7 @@ class DefaultCsrfProvider implements CsrfProviderInterface
return StringUtils::equals($expectedToken, $token); return StringUtils::equals($expectedToken, $token);
} }
return $token === $this->generateCsrfToken($intention); return $token === $expectedToken;
} }
/** /**

3
src/Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener.php
View File

@ -13,6 +13,7 @@ namespace Symfony\Component\Security\Http\Firewall;
use Symfony\Component\Security\Core\SecurityContextInterface; use Symfony\Component\Security\Core\SecurityContextInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface; use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Core\Util\StringUtils;
use Symfony\Component\Security\Http\EntryPoint\DigestAuthenticationEntryPoint; use Symfony\Component\Security\Http\EntryPoint\DigestAuthenticationEntryPoint;
use Psr\Log\LoggerInterface; use Psr\Log\LoggerInterface;
use Symfony\Component\HttpKernel\Event\GetResponseEvent; use Symfony\Component\HttpKernel\Event\GetResponseEvent;
@ -99,7 +100,7 @@ class DigestAuthenticationListener implements ListenerInterface
return; return;
} }
if ($serverDigestMd5 !== $digestAuth->getResponse()) { if (!StringUtils::equals($serverDigestMd5, $digestAuth->getResponse())) {
if (null !== $this->logger) { if (null !== $this->logger) {
$this->logger->debug(sprintf('Expected response: "%s" but received: "%s"; is AuthenticationDao returning clear text passwords?', $serverDigestMd5, $digestAuth->getResponse())); $this->logger->debug(sprintf('Expected response: "%s" but received: "%s"; is AuthenticationDao returning clear text passwords?', $serverDigestMd5, $digestAuth->getResponse()));
} }