haskell/yesod
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #697 from vincenthz/master

Browse Source 
Use const time equality from byteable instead of crypto-api
This commit is contained in:
Michael Snoyman 2014-03-18 14:13:20 +02:00
commit bb97d83853
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
yesod-form/Yesod/Form/Functions.hs
View File

@ -50,7 +50,7 @@ import Control.Arrow (second)
import Control.Monad.Trans.RWS (ask, get, put, runRWST, tell, evalRWST, local) import Control.Monad.Trans.RWS (ask, get, put, runRWST, tell, evalRWST, local)
import Control.Monad.Trans.Class import Control.Monad.Trans.Class
import Control.Monad (liftM, join) import Control.Monad (liftM, join)
import Crypto.Classes (constTimeEq) import Data.Byteable (constEqBytes)
import Text.Blaze (Markup, toMarkup) import Text.Blaze (Markup, toMarkup)
#define Html Markup #define Html Markup
#define toHtml toMarkup #define toHtml toMarkup
@ -223,7 +223,7 @@ postHelper form env = do
| not (Map.lookup tokenKey params === reqToken req) -> | not (Map.lookup tokenKey params === reqToken req) ->
FormFailure [renderMessage m langs MsgCsrfWarning] FormFailure [renderMessage m langs MsgCsrfWarning]
_ -> res _ -> res
where (Just [t1]) === (Just t2) = TE.encodeUtf8 t1 `constTimeEq` TE.encodeUtf8 t2 where (Just [t1]) === (Just t2) = TE.encodeUtf8 t1 `constEqBytes` TE.encodeUtf8 t2
Nothing === Nothing = True -- It's important to use constTimeEq Nothing === Nothing = True -- It's important to use constTimeEq
_ === _ = False -- in order to avoid timing attacks. _ === _ = False -- in order to avoid timing attacks.
return ((res', xml), enctype) return ((res', xml), enctype)

2
yesod-form/yesod-form.cabal
View File

@ -35,7 +35,7 @@ library
, blaze-html >= 0.5 , blaze-html >= 0.5
, blaze-markup >= 0.5.1 , blaze-markup >= 0.5.1
, attoparsec >= 0.10 , attoparsec >= 0.10
, crypto-api >= 0.8 , byteable
, aeson , aeson
, resourcet , resourcet