twilio/twilio-php — pull request #202 by sarciszewski (2014-11-19 21:45:42+00:00)
Title: Update RequestValidator.php

The current implementation of `Service_Twilio_RequestValidator` has a couple of security concerns that are remotely exploitable:

1. Signatures are compared using the non-strict `==` operator (See: https://eval.in/108854 for why this is bad in PHP)
2. Invalid signatures will take longer to fail the more leftmost bytes are correct (this is called a timing attack, and can be used to brute-force a signature).

This patch polyfills a `hash_equals()` implementation in case PHP < 5.6.0 in installed; otherwise, it uses the native implementation.