mitigate CSRF timing attack vulnerability

xabbuh · fabpot · commit 557ea17eeb21 · 2015-11-23T11:02:49.000+01:00
diff --git a/src/Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider.php b/src/Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider.php
@@ -11,6 +11,8 @@
 
 namespace Symfony\Component\Form\Extension\Csrf\CsrfProvider;
 
+use Symfony\Component\Security\Core\Util\StringUtils;
+
 /**
  * Default implementation of CsrfProviderInterface.
  *
@@ -54,6 +56,16 @@ public function generateCsrfToken($intention)
      */
     public function isCsrfTokenValid($intention, $token)
     {
+        $expectedToken = $this->generateCsrfToken($intention);
+
+        if (function_exists('hash_equals')) {
+            return hash_equals($expectedToken, $token);
+        }
+
+        if (class_exists('Symfony\Component\Security\Core\Util\StringUtils')) {
+            return StringUtils::equals($expectedToken, $token);
+        }
+
         return $token === $this->generateCsrfToken($intention);
     }
 
