mozilla/badgekit-api — pull request #71 by brianloveswords (2014-04-17 06:49:37+00:00)
Title: Fix verification middleware

This fixes a subtle issue that could cause verification to fail when
trying to handle bodies that contain multibyte characters. This is best
illustrated with an example from the REPL:

```
> crypto.createHash('sha256').update(' ').digest('hex')
'9652595f37edd08c51dfa26567e6cd76e6fa2709c3e578478ca398d316837a7a'

> crypto.createHash('sha256').update(Buffer(' ', binary')).digest('hex')
'9652595f37edd08c51dfa26567e6cd76e6fa2709c3e578478ca398d316837a7a'

> crypto.createHash('sha256').update(Buffer(' ')).digest('hex')
'78d9ce976067aaa5aa9024c17a726c9b121d14abb73ac7644c62c70a6e1a9a5f'

```

By default, `Hash#update()` treats `data` as being binary encoded if a
string is passed and there is no optional `input_encoding`
parameter. This messes up any multibyte characters in the string and
the created hash will not match one where the encoding was set
correctly (either by passing the optional `input_encoding` parameter to
`update` or by using a Buffer directly with `update`).

This is a user error for sure, but one that is easily made and I think
we might want to be a little lax about what we accept here especially
because I don't know how other languages handle this situation.

COUNTER-POINT:
The Big 3 handle this situation pretty much correctly:

Python:
```
$ python
>>> import hashlib
>>> hashlib.sha256(' ').hexdigest()
'78d9ce976067aaa5aa9024c17a726c9b121d14abb73ac7644c62c70a6e1a9a5f'
```

PHP:
````
$ php -r 'echo hash("sha256", " ");'
78d9ce976067aaa5aa9024c17a726c9b121d14abb73ac7644c62c70a6e1a9a5f%
```

Ruby:
```
$ ruby -r Digest -e 'puts Digest::SHA256.new.update(" ").hexdigest'
78d9ce976067aaa5aa9024c17a726c9b121d14abb73ac7644c62c70a6e1a9a5f
```

So instead of actually making the hash checking more lax, we might just
want to add a line to the docs saying that if you're using node, make
sure to pass a Buffer to `Hash#update` or explicitly set the
`input_encoding` parameter to "utf8".

@cmcavoy, @arhayward to review/advise.