class

Flaw::NonConstantTimeCompare

Inherits Flaw::Rule < Reference < Object

FLAW012 — Timing attack. Equality comparison between a user-supplied value and a secret (token/password/hmac/signature) using ==. Use Crypto::Subtle.constant_time_compare instead.

Constants

COMPARE = /\b(\w+)\s*==\s*(\w+)/
SENSITIVE = /\b(token|hmac|signature|api[_-]?key|secret|auth(?:_?header)?|csrf|mac|digest_expected|expected_(?:hmac|sig|token))\b/i

Instance methods

check(source : String, path : String) : Array(Finding)
Source
default_severity
Source
description
Source
title
Source