twilio/twilio-python — pull request #118 by zacharyvoase (2013-05-20 13:26:48+00:00)
Title: Fix the timing attack in RequestValidator

`twilio.util.RequestValidator` uses naïve string comparison (the `==` operator) to check signatures, an operation which is designed to return a value as quickly as possible. Unfortunately this means the signature check will take a variable amount of time based on how much of the submitted signature is correct. Attackers can use this timing information to determine the correct signature for a fabricated request in `O(n)` time, instead of `O(256^n)` (where `n` is the number of bytes in the signature).

This patch changes `RequestValidator` to use a secure string comparison function, which will always take a constant amount of time when comparing two strings of the same length, and thus not leak information.