X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;ds=inline;f=extlib%2FOAuth.php;h=04984d5fa0327defc0c6f1b1fe6f4c770254b96d;hb=c2c6acbfd25410f73a6bc83e8167f724c31ef22f;hp=fd485355459843c2bbf41d6240d687423d56d6f9;hpb=8399e4c2e6aef80f9c3c24f62f2b37c19e5bab81;p=quix0rs-gnu-social.git diff --git a/extlib/OAuth.php b/extlib/OAuth.php index fd48535545..04984d5fa0 100644 --- a/extlib/OAuth.php +++ b/extlib/OAuth.php @@ -54,6 +54,24 @@ class OAuthSignatureMethod {/*{{{*/ public function check_signature(&$request, $consumer, $token, $signature) { $built = $this->build_signature($request, $consumer, $token); return $built == $signature; + + // Check for zero length, although unlikely here + if (strlen($built) == 0 || strlen($signature) == 0) { + return false; + } + + if (strlen($built) != strlen($signature)) { + return false; + } + + $result = 0; + + // Avoid a timing leak with a (hopefully) time insensitive compare + for ($i = 0; $i < strlen($signature); $i++) { + $result |= ord($built{$i}) ^ ord($signature{$i}); + } + + return $result == 0; } }/*}}}*/ @@ -327,7 +345,7 @@ class OAuthRequest {/*{{{*/ public function get_normalized_http_url() {/*{{{*/ $parts = parse_url($this->http_url); - $port = @$parts['port']; + $port = isset($parts['port']) ? $parts['port'] : null; $scheme = $parts['scheme']; $host = $parts['host']; $path = @$parts['path'];