Use secure_compare to verify the validity of the provided HMAC

1fb58b15 · Douglas Barbosa Alexandre · 3ac5f670 · 1fb58b15
Commit 1fb58b15 authored Feb 14, 2019 by Douglas Barbosa Alexandre
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

ee/lib/gitlab/geo/oauth/login_state.rb ee/lib/gitlab/geo/oauth/login_state.rb +1 -1

No files found.
--- a/ee/lib/gitlab/geo/oauth/login_state.rb
+++ b/ee/lib/gitlab/geo/oauth/login_state.rb
@@ -20,7 +20,7 @@ module Gitlab
        def valid?
          return false unless salt.present? && hmac.present?

-          hmac == generate_hmac
+          ActiveSupport::SecurityUtils.secure_compare(hmac, generate_hmac)
        end

        def encode