Current section
13 Versions
Jump to
Current section
13 Versions
Compare versions
4
files changed
+25
additions
-13
deletions
| @@ -1,5 +1,9 @@ | |
| 1 1 | # Changelog |
| 2 2 | |
| 3 | + ## v2.1.1 (2025-04-03) |
| 4 | + |
| 5 | + * Fall back `hash_equals` when missing OpenSSL support |
| 6 | + |
| 3 7 | ## v2.1.0 (2024-05-02) |
| 4 8 | |
| 5 9 | * Use `System.os_time/1` as the token signing date, since tokens are meant to be shared across machines |
| @@ -1,11 +1,9 @@ | |
| 1 1 | {<<"links">>, |
| 2 2 | [{<<"GitHub">>,<<"https://github.com/elixir-plug/plug_crypto">>}]}. |
| 3 3 | {<<"name">>,<<"plug_crypto">>}. |
| 4 | - {<<"version">>,<<"2.1.0">>}. |
| 4 | + {<<"version">>,<<"2.1.1">>}. |
| 5 5 | {<<"description">>,<<"Crypto-related functionality for the web">>}. |
| 6 6 | {<<"elixir">>,<<"~> 1.11">>}. |
| 7 | - {<<"app">>,<<"plug_crypto">>}. |
| 8 | - {<<"licenses">>,[<<"Apache-2.0">>]}. |
| 9 7 | {<<"files">>, |
| 10 8 | [<<"lib">>,<<"lib/plug">>,<<"lib/plug/crypto">>, |
| 11 9 | <<"lib/plug/crypto/key_generator.ex">>, |
| @@ -13,5 +11,7 @@ | |
| 13 11 | <<"lib/plug/crypto/application.ex">>, |
| 14 12 | <<"lib/plug/crypto/message_verifier.ex">>,<<"lib/plug/crypto.ex">>, |
| 15 13 | <<"mix.exs">>,<<"README.md">>,<<"CHANGELOG.md">>,<<"LICENSE">>]}. |
| 14 | + {<<"app">>,<<"plug_crypto">>}. |
| 15 | + {<<"licenses">>,[<<"Apache-2.0">>]}. |
| 16 16 | {<<"requirements">>,[]}. |
| 17 17 | {<<"build_tools">>,[<<"mix">>]}. |
| @@ -133,22 +133,30 @@ defmodule Plug.Crypto do | |
| 133 133 | # TODO: remove when we require OTP 25.0 |
| 134 134 | if Code.ensure_loaded?(:crypto) and function_exported?(:crypto, :hash_equals, 2) do |
| 135 135 | defp crypto_hash_equals(x, y) do |
| 136 | - :crypto.hash_equals(x, y) |
| 136 | + # Depending on the linked OpenSSL library hash_equals is available. |
| 137 | + # If not, we fall back to the legacy implementation. |
| 138 | + try do |
| 139 | + :crypto.hash_equals(x, y) |
| 140 | + rescue |
| 141 | + # Still can throw "Unsupported CRYPTO_memcmp" |
| 142 | + ErlangError -> |
| 143 | + legacy_secure_compare(x, y, 0) |
| 144 | + end |
| 137 145 | end |
| 138 146 | else |
| 139 147 | defp crypto_hash_equals(x, y) do |
| 140 148 | legacy_secure_compare(x, y, 0) |
| 141 149 | end |
| 150 | + end |
| 142 151 | |
| 143 | - defp legacy_secure_compare(<<x, left::binary>>, <<y, right::binary>>, acc) do |
| 144 | - import Bitwise |
| 145 | - xorred = bxor(x, y) |
| 146 | - legacy_secure_compare(left, right, acc ||| xorred) |
| 147 | - end |
| 152 | + defp legacy_secure_compare(<<x, left::binary>>, <<y, right::binary>>, acc) do |
| 153 | + import Bitwise |
| 154 | + xorred = bxor(x, y) |
| 155 | + legacy_secure_compare(left, right, acc ||| xorred) |
| 156 | + end |
| 148 157 | |
| 149 | - defp legacy_secure_compare(<<>>, <<>>, acc) do |
| 150 | - acc === 0 |
| 151 | - end |
| 158 | + defp legacy_secure_compare(<<>>, <<>>, acc) do |
| 159 | + acc === 0 |
| 152 160 | end |
| 153 161 | |
| 154 162 | @doc """ |
| @@ -1,7 +1,7 @@ | |
| 1 1 | defmodule Plug.Crypto.MixProject do |
| 2 2 | use Mix.Project |
| 3 3 | |
| 4 | - @version "2.1.0" |
| 4 | + @version "2.1.1" |
| 5 5 | @description "Crypto-related functionality for the web" |
| 6 6 | @source_url "https://github.com/elixir-plug/plug_crypto" |