Use secure_compare during signature verification

Author: hieuk09

lib/slack/events/request.rb

@@ -59,7 +59,7 @@ def valid?
         signature_basestring = [version, timestamp, body].join(':')
         hex_hash = OpenSSL::HMAC.hexdigest(digest, signing_secret, signature_basestring)
         computed_signature = [version, hex_hash].join('=')
-        computed_signature == signature
+        secure_compare(computed_signature, signature)
       end
 
       # Validates the request signature and its expiration.
@@ -69,6 +69,19 @@ def verify!
 
         true
       end
+
+      private
+
+      def secure_compare(computed_signature, signature)
+        return false if computed_signature.bytesize != signature.bytesize
+
+        l = computed_signature.unpack "C#{computed_signature.bytesize}"
+
+        result = 0
+        signature.each_byte { |byte| result |= byte ^ l.shift }
+
+        result.zero?
+      end
     end
   end
 end