Merge pull request #71 from billdybas/use-timing-safe-compare

Use Timing Safe Compare

Author: aoberoi

package.json

@@ -29,7 +29,8 @@
     "lodash.isplainobject": "^4.0.6",
     "lodash.isregexp": "^4.0.1",
     "lodash.isstring": "^4.0.1",
-    "raw-body": "^2.3.3"
+    "raw-body": "^2.3.3",
+    "tsscmp": "^1.0.6"
   },
   "devDependencies": {
     "babel-cli": "^6.26.0",

src/http-handler.js

@@ -2,6 +2,7 @@ import debugFactory from 'debug';
 import getRawBody from 'raw-body';
 import querystring from 'querystring';
 import crypto from 'crypto';
+import timingSafeCompare from 'tsscmp';
 import { packageIdentifier } from './util';
 
 const debug = debugFactory('@slack/interactive-messages:http-handler');
@@ -80,7 +81,7 @@ export function createHTTPHandler(adapter) {
     const [version, hash] = signature.split('=');
     hmac.update(`${version}:${ts}:${body}`);
 
-    if (hash !== hmac.digest('hex')) {
+    if (!timingSafeCompare(hash, hmac.digest('hex'))) {
       debug('request signature is not valid');
       const error = new Error('Slack request signing verification failed');
       error.code = errorCodes.SIGNATURE_VERIFICATION_FAILURE;