Merge pull request Shopify#349 from mikeyhew/fixed-size-secure-compare

Use fixed-size `secure_compare` in `WebhookVerification#hmac_valid?`
obhasha · Oct 11, 2016 · d9220f0 · d9220f0
2 parents 47f8019 + 7fd2986
commit d9220f0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/shopify_app/webhook_verification.rb b/lib/shopify_app/webhook_verification.rb
@@ -22,7 +22,7 @@ def verify_request
     def hmac_valid?(data)
       secret = ShopifyApp.configuration.secret
       digest = OpenSSL::Digest.new('sha256')
-      ActiveSupport::SecurityUtils.variable_size_secure_compare(
+      ActiveSupport::SecurityUtils.secure_compare(
         shopify_hmac,
         Base64.encode64(OpenSSL::HMAC.digest(digest, secret, data)).strip
       )