8000 security #cve-2019-18887 [HttpKernel] Use constant time comparison in… · symfony/symfony@9cbe360 · GitHub
[go: up one dir, main page]
Skip to content

Commit 9cbe360

Browse files
nicolas-grekasnicolas-grekas
committed
security #cve-2019-18887 [HttpKernel] Use constant time comparison in UriSigner (stof)
This PR was merged into the 4.2 branch.
2 parents 9fa32f4 + cccefe6 commit 9cbe360

File tree

2 files changed

+2
-1
lines changed

2 files changed

+2
-1
lines changed

‎src/Symfony/Component/HttpKernel/UriSigner.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public function check($uri)
7979
$hash = $params[$this->parameter];
8080
unset($params[$this->parameter]);
8181

82-
return $this->computeHash($this->buildUrl($url, $params)) === $hash;
82+
return hash_equals($this->computeHash($this->buildUrl($url, $params)), $hash);
8383
}
8484

8585
private function computeHash($uri)

‎src/Symfony/Component/HttpKernel/composer.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
"symfony/http-foundation": "^4.1.1",
2323
"symfony/debug": "~3.4|~4.0",
2424
"symfony/polyfill-ctype": "~1.8",
25+
"symfony/polyfill-php56": "~1.8",
2526
"psr/log": "~1.0"
2627
},
2728
"require-dev": {

0 commit comments

Comments
 (0)
0