ChristopherSchultz commented on PR #1028: URL: https://github.com/apache/tomcat/pull/1028#issuecomment-4982450711
-1 Using the user-provided string first means the runtime of the function is determined by the user's provided value which is the intended behavior. Swapping these arguments means that the server-trusted argument is used to determine the runtime of the comparison instead of the user-provided String, which could potentially leak timing information about the stored (presumably secret) credential. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
