Merge pull request #704 from Mashape/hotfix/hmac-constant-digest-compare

[hotfix/hmac-auth] constant digest comparision

kong/plugins/hmac-auth/access.lua

@@ -81,10 +81,24 @@ local function create_hash(request, hmac_params, headers)
   return ngx_sha1(hmac_params.secret, signing_string)
 end
 
+local function is_digest_equal(digest_1, digest_2)
+  if #digest_1 ~= #digest_1 then
+    return false
+  end
+
+  local result = true
+  for i=1, #digest_1 do
+    if digest_1:sub(i, i) ~= digest_2:sub(i, i) then
+      result = false
+    end  
+  end    
+  return result
+end    
+
 local function validate_signature(request, hmac_params, headers)
   local digest = create_hash(request, hmac_params, headers)
   if digest then
-    return digest == ngx_decode_base64(hmac_params.signature)
+   return is_digest_equal(digest, ngx_decode_base64(hmac_params.signature))
   end
 end