)]}'
{"anchor/auth/__init__.py":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"279ed8d1a304249c162ab9e3f0b7af2e6896c010","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        valid_user \u003d hmac.compare_digest(user,"},{"line_number":39,"context_line":"                                         conf.auth[\u0027static\u0027][\u0027user\u0027])"},{"line_number":40,"context_line":"        if valid_secret and valid_user:"},{"line_number":41,"context_line":"            return AuthDetails(username\u003dconf.auth[\u0027static\u0027][\u0027user\u0027], groups\u003d[])"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    if conf.auth.get(\u0027ldap\u0027):"},{"line_number":44,"context_line":"        res \u003d ldap.login(user, secret)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_e7d85155","line":41,"updated":"2015-02-18 01:24:19.000000000","message":"is this constant time, I think \"valid_secret and valid_user\" will evaluate differently based on valid_secret being true or not. How about .....\n\n\nflag \u003d (valid_secret and valid_user)\n\nif flag:\n  do_stuff","commit_id":"90089b66059bd908a595f09fe0e769e6b5191aca"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"1ce02dd58c30b51c44347e849f330728a9b55814","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        valid_user \u003d hmac.compare_digest(user,"},{"line_number":39,"context_line":"                                         conf.auth[\u0027static\u0027][\u0027user\u0027])"},{"line_number":40,"context_line":"        if valid_secret and valid_user:"},{"line_number":41,"context_line":"            return AuthDetails(username\u003dconf.auth[\u0027static\u0027][\u0027user\u0027], groups\u003d[])"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    if conf.auth.get(\u0027ldap\u0027):"},{"line_number":44,"context_line":"        res \u003d ldap.login(user, secret)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_10667c51","line":41,"in_reply_to":"da86d52c_2ae4edde","updated":"2015-02-18 04:50:49.000000000","message":"hummm, yes i think your right. Probably worth adding a comment at least to indicate we are aware of the issue","commit_id":"90089b66059bd908a595f09fe0e769e6b5191aca"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"facde48671b6883e1a3fa975b2c7b4cc09fd14a4","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        valid_user \u003d hmac.compare_digest(user,"},{"line_number":39,"context_line":"                                         conf.auth[\u0027static\u0027][\u0027user\u0027])"},{"line_number":40,"context_line":"        if valid_secret and valid_user:"},{"line_number":41,"context_line":"            return AuthDetails(username\u003dconf.auth[\u0027static\u0027][\u0027user\u0027], groups\u003d[])"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    if conf.auth.get(\u0027ldap\u0027):"},{"line_number":44,"context_line":"        res \u003d ldap.login(user, secret)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_2ae4edde","line":41,"in_reply_to":"da86d52c_e7d85155","updated":"2015-02-18 03:15:09.000000000","message":"You are correct.  I mentioned this in my commit message.  However, I believe your suggested solution suffers from the same issue.  I didn\u0027t see an obvious fix and I wasn\u0027t sure if it was worth worrying about.","commit_id":"90089b66059bd908a595f09fe0e769e6b5191aca"}]}