haskell/yesod
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move from byteable to memory

Browse Source
This commit is contained in:
Michael Snoyman 2019-02-19 03:58:31 +02:00
parent b1e718397b
commit e5cc9987ae
No known key found for this signature in database
GPG Key ID: A048E8C057E86876
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
yesod-core/Yesod/Core/Handler.hs
View File

@ -228,7 +228,7 @@ import qualified Data.ByteString.Lazy as L
import qualified Data.Map as Map import qualified Data.Map as Map
import qualified Data.HashMap.Strict as HM import qualified Data.HashMap.Strict as HM
import Data.Byteable (constEqBytes) import Data.ByteArray (constEq)
import Control.Arrow ((***)) import Control.Arrow ((***))
import qualified Data.ByteString.Char8 as S8 import qualified Data.ByteString.Char8 as S8
@ -1648,8 +1648,8 @@ checkCsrfHeaderOrParam headerName paramName = do
permissionDenied errorMessage permissionDenied errorMessage
validCsrf :: Maybe Text -> Maybe S.ByteString -> Bool validCsrf :: Maybe Text -> Maybe S.ByteString -> Bool
-- It's important to use constant-time comparison (constEqBytes) in order to avoid timing attacks. -- It's important to use constant-time comparison (constEq) in order to avoid timing attacks.
validCsrf (Just token) (Just param) = encodeUtf8 token `constEqBytes` param validCsrf (Just token) (Just param) = encodeUtf8 token `constEq` param
validCsrf Nothing _param = True validCsrf Nothing _param = True
validCsrf (Just _token) Nothing = False validCsrf (Just _token) Nothing = False

2
yesod-core/yesod-core.cabal
View File

@ -27,7 +27,6 @@ library
, auto-update , auto-update
, blaze-html >= 0.5 , blaze-html >= 0.5
, blaze-markup >= 0.7.1 , blaze-markup >= 0.7.1
, byteable
, bytestring >= 0.10.2 , bytestring >= 0.10.2
, case-insensitive >= 0.2 , case-insensitive >= 0.2
, cereal >= 0.3 , cereal >= 0.3
@ -39,6 +38,7 @@ library
, deepseq >= 1.3 , deepseq >= 1.3
, fast-logger >= 2.2 , fast-logger >= 2.2
, http-types >= 0.7 , http-types >= 0.7
, memory
, monad-logger >= 0.3.10 && < 0.4 , monad-logger >= 0.3.10 && < 0.4
, mtl , mtl
, parsec >= 2 && < 3.2 , parsec >= 2 && < 3.2