Enforce time safe string comparison. (#831)

gnikyt · Jun 23, 2021 · 1049337 · 1049337
1 parent 2fde0a9
commit 1049337
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/src/ShopifyApp/Http/Middleware/AuthProxy.php b/src/ShopifyApp/Http/Middleware/AuthProxy.php
@@ -63,7 +63,7 @@ public function handle(Request $request, Closure $next)
             ],
             getShopifyConfig('api_secret', $shop)
         );
-        if ($signature !== $signatureLocal || $shop->isNull()) {
+        if (hash_equals($signature, $signatureLocal) === false || $shop->isNull()) {
             // Issue with HMAC or missing shop header
             return Response::make('Invalid proxy signature.', 401);
         }

diff --git a/src/ShopifyApp/Http/Middleware/AuthToken.php b/src/ShopifyApp/Http/Middleware/AuthToken.php
@@ -127,6 +127,6 @@ private function checkSignature($token)
         $hmac = hash_hmac('sha256', $check, $secret, true);
         $encoded = base64url_encode($hmac);
 
-        return $encoded === $signature;
+        return hash_equals($encoded, $signature);
     }
 }
diff --git a/src/ShopifyApp/Http/Middleware/AuthWebhook.php b/src/ShopifyApp/Http/Middleware/AuthWebhook.php
@@ -35,7 +35,7 @@ public function handle(Request $request, Closure $next)
             getShopifyConfig('api_secret', $shop)
         );
 
-        if (! hash_equals($hmac, $hmacLocal) || empty($shop)) {
+        if (hash_equals($hmac, $hmacLocal) === false || empty($shop)) {
             // Issue with HMAC or missing shop header
             return Response::make('Invalid webhook signature.', 401);
         }