constant time comparsion does not actually add any value

mojolicious · Oct 12, 2015 · e8f9a0e · e8f9a0e
1 parent 5906ddc
commit e8f9a0e
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/lib/Mojolicious/Validator/Validation.pm b/lib/Mojolicious/Validator/Validation.pm
@@ -1,8 +1,7 @@
 package Mojolicious::Validator::Validation;
 use Mojo::Base -base;
 
-use Carp ();
-use Mojo::Util 'secure_compare';
+use Carp         ();
 use Scalar::Util ();
 
 has [qw(csrf_token topic validator)];
@@ -39,7 +38,7 @@ sub csrf_protect {
   my $self  = shift;
   my $token = $self->input->{csrf_token};
   $self->error(csrf_token => ['csrf_protect'])
-    unless $token && secure_compare($token, $self->csrf_token // '');
+    unless $token && $token eq ($self->csrf_token // '');
   return $self;
 }