From 0979b67e1baf88d7534d39c9744801a54d487b7f Mon Sep 17 00:00:00 2001
From: nashe <thomas@chauchefoin.fr>
Date: Mon, 18 Dec 2017 22:59:42 +0100
Subject: Add hash_equals polyfill and related tests

---
 app/helpers.php       | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 tests/HelpersTest.php | 15 +++++++++++++++
 2 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 tests/HelpersTest.php

diff --git a/app/helpers.php b/app/helpers.php
index 3bce65f..8765fc6 100644
--- a/app/helpers.php
+++ b/app/helpers.php
@@ -1,5 +1,23 @@
 <?php
 
+/**
+ * Register polyfills for old PHP versions.
+ * 
+ * This way, the real function will only be called if it
+ * is available, and we won't force the use of our own 
+ * implementation.
+ */
+function register_polyfills()
+{
+    if (!function_exists('hash_equals')) {
+        function hash_equals($known_string, $user_string) {
+            call_user_func_array('_hash_equals', func_get_args());
+        }
+    }
+}
+
+register_polyfills();
+
 /**
  * Path to the _custom_ directory.
  *
@@ -72,4 +90,36 @@ function removeCustomFiles()
             unlink($path);
         }
     }
-}
\ No newline at end of file
+}
+
+/**
+ * Compare two strings in a constant-time manner.
+ *
+ * It returns `true` if both strings are exactly the same
+ * (same size and same value).
+ *
+ * @param  string $known_string
+ * @param  string $user_string
+ * @return bool
+ */
+function _hash_equals($known_string = '', $user_string = '')
+{
+    // In our case, it's not problematic if `$known_string`'s 
+    // size leaks, we will only compare password hashes and 
+    // CSRF tokens—their size is already somehow public.
+    if (!is_string($known_string) || !is_string($user_string) 
+         || strlen($known_string) !== strlen($user_string)) {
+        return false;
+    }
+
+    $ret = 0;    
+
+    // Do not stop the comparison when a difference is found,
+    // always completely compare them.
+    for ($i = 0; $i < strlen($known_string); $i++) {
+        $ret |=  (ord($known_string[$i]) ^ ord($user_string[$i]));
+    }   
+
+    return !$ret;
+}
+
diff --git a/tests/HelpersTest.php b/tests/HelpersTest.php
new file mode 100644
index 0000000..141e604
--- /dev/null
+++ b/tests/HelpersTest.php
@@ -0,0 +1,15 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+class HelpersTest extends TestCase
+{
+    function test_constant_time_compare()
+    {
+        $this->assertTrue(_hash_equals('abc', 'abc'));
+        $this->assertFalse(_hash_equals('abc', 'ab'));
+        $this->assertFalse(_hash_equals('ab', 'abc'));
+        $this->assertFalse(_hash_equals('abcd', 'adbc'));
+        $this->assertFalse(_hash_equals(0, 0));
+    }
+}
-- 
cgit v1.2.1