Ticket #17040: fix-1740-separate-function-for-py3.patch

django/utils/crypto.py

@@ -4 +4 @@
 
 import hashlib
 import hmac
+import sys
 from django.conf import settings
+from django.utils.encoding import smart_str
 from django.utils.py3 import b
 
 def salted_hmac(key_salt, value, secret=None):
@@ -28 +30 @@
     # However, we need to ensure that we *always* do this.
     return hmac.new(key, msg=value, digestmod=hashlib.sha1)
 
-def constant_time_compare(val1, val2):
+def constant_time_compare_py2(val1, val2):
     """
     Returns True if the two strings are equal, False otherwise.
 
@@ -40 +42 @@
     for x, y in zip(val1, val2):
         result |= ord(x) ^ ord(y)
     return result == 0
+
+def constant_time_compare_py3(val1, val2):
+    """
+    Returns True if the two strings are equal, False otherwise.
+
+    The time taken is independent of the number of characters that match.
+    """
+    val1 = smart_str(val1)
+    val2 = smart_str(val2)
+
+    if len(val1) != len(val2):
+        return False
+    result = 0
+    for x, y in zip(val1, val2):
+        result |= x ^ y
+    return result == 0
+
+if sys.version_info < (3, 0):
+    constant_time_compare = constant_time_compare_py2
+else:
+    constant_time_compare = constant_time_compare_py3