perform a constant time comparison

mojolicious · Oct 12, 2015 · 5906ddc · 5906ddc
1 parent 0cc79c4
commit 5906ddc
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/lib/Mojolicious/Validator/Validation.pm b/lib/Mojolicious/Validator/Validation.pm
@@ -1,7 +1,8 @@
 package Mojolicious::Validator::Validation;
 use Mojo::Base -base;
 
-use Carp         ();
+use Carp ();
+use Mojo::Util 'secure_compare';
 use Scalar::Util ();
 
 has [qw(csrf_token topic validator)];
@@ -38,7 +39,7 @@ sub csrf_protect {
   my $self  = shift;
   my $token = $self->input->{csrf_token};
   $self->error(csrf_token => ['csrf_protect'])
-    unless $token && $token eq ($self->csrf_token // '');
+    unless $token && secure_compare($token, $self->csrf_token // '');
   return $self;
 }