ENGCOM-2656: [Backport] Use constant time string comparison in FormKe…

…y validator #17108
magento · Aug 6, 2018 · bd825eb · bd825eb
2 parents 5a07347 + cce5feb
commit bd825eb
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/lib/internal/Magento/Framework/Data/Form/FormKey/Validator.php b/lib/internal/Magento/Framework/Data/Form/FormKey/Validator.php
@@ -5,6 +5,8 @@
  */
 namespace Magento\Framework\Data\Form\FormKey;
 
+use Magento\Framework\Encryption\Helper\Security;
+
 class Validator
 {
     /**
@@ -29,9 +31,7 @@ public function __construct(\Magento\Framework\Data\Form\FormKey $formKey)
     public function validate(\Magento\Framework\App\RequestInterface $request)
     {
         $formKey = $request->getParam('form_key', null);
-        if (!$formKey || $formKey !== $this->_formKey->getFormKey()) {
-            return false;
-        }
-        return true;
+
+        return $formKey && Security::compareStrings($formKey, $this->_formKey->getFormKey());
     }
 }