oauth/oauth-ruby — pull request #72 by r-stu31 (2013-02-06 21:50:45+00:00)
Title: Correct verify

The `OAuth::Signature::Base#==` method currently incorrectly returns `true` even when the signature from the request does not match. See e.g. the test case in this pull request, the correct signature is `xcHYBV3AbyoDz7L4dV10P3oLCjY=` and current implementation verifies a different signature `xcHYBV3AbyoDz7L4dV10P3oLCjZ=` as also correct. This may be a security risk for OAuth servers using the `OAuth::Signature::Base#==` or `OAuth::Signature::Base#verify` methods to verify signatures submitted by clients.

Problem goes away when comparing the signatures instead of comparing the results of `Base64.decode64(signature)`.