Skip to content

replace constant_time_compare with hmac.compare_digest #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jllopezpino wants to merge 4 commits into from
Closed

replace constant_time_compare with hmac.compare_digest #58

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
81a45c3
replace constant_time_compare with hmac.compare_digest
jllopezpino May 13, 2021
47f56a3
Update setup.py
jllopezpino May 10, 2022
4b435b8
Add changes
gianfranco-s May 16, 2022
bc95724
Merge pull request #1 from shuttle99ou/lets_migrate_to_flask_image_re…
jllopezpino May 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions flask_images/core.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,7 @@
from PIL import Image, ImageFilter
from flask import request, current_app, send_file, abort

try:
Copy link

@invisiblek invisiblek Jul 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you need to keep the import of Signer

from itsdangerous import Signer, constant_time_compare
except ImportError:
from itsdangerous import Signer
from itsdangerous._compat import constant_time_compare
from hmac import compare_digest

from . import modes
from .size import ImageSize
Expand Down Expand Up @@ -307,7 +303,7 @@ def handle_request(self, path):
abort(404)
signer = Signer(current_app.secret_key)
new_sig = signer.get_signature('%s?%s' % (path, urlencode(sorted(iteritems(query)), True)))
if not constant_time_compare(str(old_sig), str(new_sig.decode('utf-8'))):
if not compare_digest(str(old_sig), str(new_sig.decode('utf-8'))):
log.warning("Signature mismatch: url's {} != expected {}".format(old_sig, new_sig))
abort(404)

Expand Down