Remove _const_compare_digest
MODIFY
src/urllib3/util/ssl_.py
src/urllib3/util/ssl_.py
@@ -19,21 +19,6 @@ ALPN_PROTOCOLS = ["http/1.1"]
HASHFUNC_MAP = {32: md5, 40: sha1, 64: sha256}
-def _const_compare_digest_backport(a, b):
- """
- Compare two digests of equal length in constant time.
-
- The digests must be of type str/bytes.
- Returns True if the digests match, and False otherwise.
- """
- result = abs(len(a) - len(b))
- for left, right in zip(bytearray(a), bytearray(b)):
- result |= left ^ right
- return result == 0
-
-
-_const_compare_digest = getattr(hmac, "compare_digest", _const_compare_digest_backport)
-
try: # Do we have ssl at all?
import ssl
from ssl import (
@@ -115,7 +100,7 @@ def assert_fingerprint(cert, fingerprint):
cert_digest = hashfunc(cert).digest()
- if not _const_compare_digest(cert_digest, fingerprint_bytes):
+ if not hmac.compare_digest(cert_digest, fingerprint_bytes):
raise SSLError(
f'Fingerprints did not match. Expected "{fingerprint}", got "{hexlify(cert_digest)}".'
)

MODIFY
test/test_util.py
test/test_util.py
-import hashlib
import io
import logging
import socket
@@ -24,12 +23,7 @@ from urllib3.util.connection import _has_ipv6, allowed_gai_family, create_connec
from urllib3.util.proxy import connection_requires_http_tunnel, create_proxy_ssl_context
from urllib3.util.request import _FAILEDTELL, make_headers, rewind_body
from urllib3.util.response import assert_header_parsing
-from urllib3.util.ssl_ import (
- _const_compare_digest_backport,
- resolve_cert_reqs,
- resolve_ssl_version,
- ssl_wrap_socket,
-)
+from urllib3.util.ssl_ import resolve_cert_reqs, resolve_ssl_version, ssl_wrap_socket
from urllib3.util.timeout import Timeout
from urllib3.util.url import Url, get_host, parse_url, split_first
from urllib3.util.util import to_bytes, to_str
@@ -669,19 +663,6 @@ class TestUtil:
with pytest.raises(ValueError):
is_fp_closed(NotReallyAFile())
- def test_const_compare_digest_fallback(self):
- target = hashlib.sha256(b"abcdef").digest()
- assert _const_compare_digest_backport(target, target)
-
- prefix = target[:-1]
- assert not _const_compare_digest_backport(target, prefix)
-
- suffix = target + b"0"
- assert not _const_compare_digest_backport(target, suffix)
-
- incorrect = hashlib.sha256(b"xyz").digest()
- assert not _const_compare_digest_backport(target, incorrect)
-
def test_has_ipv6_disabled_on_compile(self):
with patch("socket.has_ipv6", False):
assert not _has_ipv6("::1")

Remove _const_compare_digest