Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Issue #1556 - A timing channel in Password.java. 

Fixed comparison logic, doh.
This commit is contained in:
Simone Bordet 2017-05-16 16:34:04 +02:00
parent 042f325f1c
commit f3751d7078
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
jetty-util/src/main/java/org/eclipse/jetty/util/security/Credential.java
View File

@ -84,9 +84,9 @@ public abstract class Credential implements Serializable
return true; return true;
if (s1 == null || s2 == null || s1.length() != s2.length()) if (s1 == null || s2 == null || s1.length() != s2.length())
return false; return false;
boolean result = false; boolean result = true;
for (int i = 0; i < s1.length(); i++) for (int i = 0; i < s1.length(); i++)
result |= s1.charAt(i) == s2.charAt(i); result &= s1.charAt(i) == s2.charAt(i);
return result; return result;
} }
@ -103,9 +103,9 @@ public abstract class Credential implements Serializable
return true; return true;
if (b1 == null || b2 == null || b1.length != b2.length) if (b1 == null || b2 == null || b1.length != b2.length)
return false; return false;
boolean result = false; boolean result = true;
for (int i = 0; i < b1.length; i++) for (int i = 0; i < b1.length; i++)
result |= b1[i] == b2[i]; result &= b1[i] == b2[i];
return result; return result;
} }