Commit 03401701 authored by Donald Stufft's avatar Donald Stufft
Browse files

Merge pull request #2600 from alex/builtin-constant-time-compare 

Use the stdlib's compare_digest for constant time comparisons when available
parents 9fb95dfc 58176dee

django/utils/crypto.py

+23 −19
Original line number Diff line number Diff line
@@ -77,6 +77,10 @@ def get_random_string(length=12, 
    return ''.join(random.choice(allowed_chars) for i in range(length))





if hasattr(hmac, "compare_digest"):

    # Prefer the stdlib implementation, when available.

    constant_time_compare = hmac.compare_digest

else:

    def constant_time_compare(val1, val2):

        """

        Returns True if the two strings are equal, False otherwise.