#36572: Deprecation of constant_time_compare broke usage with mixed-type
arguments.
-------------------------------+--------------------------------------
Reporter: Sage Abdullah | Owner: (none)
Type: Bug | Status: new
Component: Utilities | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------------------------
Comment (by Tim Graham):
I hadn't noticed that the original patch changed the implementation of
`constant_time_compare()` (removing `force_bytes()`). With this new
information, that's certainly inappropriate.
I suppose there's a larger question of whether we keep the
`constant_time_compare()` API since we now learned it provides genuinely
different functionality that third-party code is relying on (comparing
strings with non-ASCII characters and arguments of different type) than
`hmac.compare_digest()`. In argument against keeping it, it forces third-
parties to identify these areas and add their own casting rather than
imposing a casting penalty where it's unneeded.
As far as I see, Django itself doesn't need to use
`constant_time_compare()` internally since in always compares digests.
Well, `hmac.compare_digest(request.session.get(HASH_SESSION_KEY, ""),
session_auth_hash)` looks like the empty string needs to become a
bytestring.
At this point in the release cycle, probably it's best to revert the
deprecation to consider this more carefully. A later first step could be
to replace internal usage of `constant_time_compare()` with
`compare_digest()` (part of the original patch, but checked more carefully
to make sure a str/bytes comparison can't happen).
--
Ticket URL: <https://code.djangoproject.com/ticket/36572#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/01070198e5e2b779-8f8827d2-618a-4e4a-8abd-f605d1c6c9f5-000000%40eu-central-1.amazonses.com.
