@ansugroup/timing-safe-equal
Version:
> Nodejs, Browser
42 lines (41 loc) • 1.5 kB
JavaScript
;
// https://github.com/ANSUGroup/shopify/issues/1
// https://en.wikipedia.org/wiki/Timing_attack
// Reference from: https://github.com/Bruce17/safe-compare/blob/master/index.js
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
const crypto_1 = __importDefault(require("crypto"));
const buffer_alloc_unsafe_1 = __importDefault(require("@stdlib/buffer-alloc-unsafe"));
const safeCompare = (a, b) => {
const strA = String(a);
let strB = String(b);
const lenA = strA.length;
let result = 0;
if (lenA !== strB.length) {
strB = strA;
result = 1;
}
for (var i = 0; i < lenA; i++) {
result |= strA.charCodeAt(i) ^ strB.charCodeAt(i);
}
return result === 0;
};
const nativeTimingSafeEqual = (a, b) => {
const strA = String(a);
const strB = String(b);
const aLen = Buffer.byteLength(strA);
const bLen = Buffer.byteLength(strB);
const bufA = buffer_alloc_unsafe_1.default(aLen);
bufA.write(strA);
const bufB = buffer_alloc_unsafe_1.default(aLen);
bufB.write(strB);
return crypto_1.default.timingSafeEqual(bufA, bufB) && aLen === bLen;
};
const timingSafeEqual = (a, b) => {
return typeof crypto_1.default.timingSafeEqual !== "undefined"
? nativeTimingSafeEqual(a, b)
: safeCompare(a, b);
};
exports.default = timingSafeEqual;