Fix timing attack vulnerability in ActiveSupport::MessageVerifier.
Fix timing attack vulnerability in ActiveSupport::MessageVerifier.

Use a constant-time comparison algorithm to compare the candidate HMAC with the calculated HMAC to prevent leaking information about the calculated HMAC.

Signed-off-by: Michael Koziarski <17b9e1c64588c7fa6419b4d29dc1f4426279ba01@koziarski.com>

riseshia/railsguides.kr,ngpestelos/rails,xlymian/rails,prathamesh-sonpatki/rails,betesh/rails,tjschuck/rails,repinel/rails,brchristian/rails,iainbeeston/rails,samphilipd/rails,yahonda/rails,yalab/rails,kamipo/rails,riseshia/railsguides.kr,tijwelch/rails,lcreid/rails,kmayer/rails,richseviora/rails,ngpestelos/rails,assain/rails,yawboakye/rails,riseshia/railsguides.kr,88rabbit/newRails,gfvcastro/rails,tgxworld/rails,gfvcastro/rails,fabianoleittes/rails,MSP-Greg/rails,richseviora/rails,alecspopa/rails,vassilevsky/rails,sealocal/rails,illacceptanything/illacceptanything,baerjam/rails,prathamesh-sonpatki/rails,mtsmfm/rails,utilum/rails,georgeclaghorn/rails,untidy-hair/rails,hanystudy/rails,ngpestelos/rails,kaspth/rails,travisofthenorth/rails,Edouard-chin/rails,yalab/rails,rafaelfranca/omg-rails,ttanimichi/rails,rbhitchcock/rails,rails/rails,Vasfed/rails,voray/rails,vipulnsward/rails,gavingmiller/rails,bolek/rails,Stellenticket/rails,marklocklear/rails,coreyward/rails,mohitnatoo/rails,kachick/rails,elfassy/rails,illacceptanything/illacceptanything,amoody2108/TechForJustice,yahonda/rails,samphilipd/rails,aditya-kapoor/rails,koic/rails,printercu/rails,kirs/rails-1,mechanicles/rails,88rabbit/newRails,mtsmfm/rails,voray/rails,illacceptanything/illacceptanything,tijwelch/rails,ttanimichi/rails,shioyama/rails,shioyama/rails,illacceptanything/illacceptanything,travisofthenorth/rails,voray/rails,matrinox/rails,esparta/rails,Erol/rails,yasslab/railsguides.jp,elfassy/rails,kddeisz/rails,printercu/rails,Erol/rails,baerjam/rails,mijoharas/rails,kmayer/rails,kamipo/rails,aditya-kapoor/rails,rbhitchcock/rails,felipecvo/rails,amoody2108/TechForJustice,joonyou/rails,starknx/rails,yahonda/rails,sergey-alekseev/rails,mijoharas/rails,arunagw/rails,MichaelSp/rails,shioyama/rails,pschambacher/rails,flanger001/rails,illacceptanything/illacceptanything,Edouard-chin/rails,kirs/rails-1,notapatch/rails,pvalena/rails,yawboakye/rails,pschambacher/rails,mechanicles/rails,kenta-s/rails,Edouard-chin/rails,bogdanvlviv/rails,baerjam/rails,pvalena/rails,gcourtemanche/rails,rossta/rails,sergey-alekseev/rails,mathieujobin/reduced-rails-for-travis,alecspopa/rails,MSP-Greg/rails,untidy-hair/rails,gfvcastro/rails,mijoharas/rails,schuetzm/rails,yhirano55/rails,utilum/rails,bolek/rails,rafaelfranca/omg-rails,georgeclaghorn/rails,yasslab/railsguides.jp,schuetzm/rails,bogdanvlviv/rails,betesh/rails,illacceptanything/illacceptanything,notapatch/rails,ttanimichi/rails,jeremy/rails,Stellenticket/rails,arunagw/rails,vipulnsward/rails,notapatch/rails,pschambacher/rails,shioyama/rails,palkan/rails,lucasmazza/rails,Stellenticket/rails,utilum/rails,Spin42/rails,kenta-s/rails,felipecvo/rails,pvalena/rails,repinel/rails,mechanicles/rails,jeremy/rails,yasslab/railsguides.jp,yhirano55/rails,ledestin/rails,iainbeeston/rails,arjes/rails,bradleypriest/rails,88rabbit/newRails,eileencodes/rails,arjes/rails,deraru/rails,maicher/rails,eileencodes/rails,iainbeeston/rails,notapatch/rails,hanystudy/rails,mohitnatoo/rails,Spin42/rails,arjes/rails,bogdanvlviv/rails,gcourtemanche/rails,mtsmfm/railstest,prathamesh-sonpatki/rails,matrinox/rails,bradleypriest/rails,gavingmiller/rails,Sen-Zhang/rails,vassilevsky/rails,flanger001/rails,schuetzm/rails,mtsmfm/rails,starknx/rails,yawboakye/rails,rafaelfranca/omg-rails,Spin42/rails,rails/rails,ledestin/rails,georgeclaghorn/rails,marklocklear/rails,kaspth/rails,deraru/rails,kddeisz/rails,Erol/rails,palkan/rails,kirs/rails-1,brchristian/rails,yasslab/railsguides.jp,marklocklear/rails,hanystudy/rails,MSP-Greg/rails,betesh/rails,maicher/rails,alecspopa/rails,kenta-s/rails,joonyou/rails,stefanmb/rails,EmmaB/rails-1,BlakeWilliams/rails,sealocal/rails,lucasmazza/rails,tgxworld/rails,kmcphillips/rails,ledestin/rails,yhirano55/rails,mohitnatoo/rails,riseshia/railsguides.kr,Envek/rails,felipecvo/rails,vassilevsky/rails,lcreid/rails,deraru/rails,yalab/rails,brchristian/rails,illacceptanything/illacceptanything,prathamesh-sonpatki/rails,gauravtiwari/rails,Sen-Zhang/rails,jeremy/rails,palkan/rails,EmmaB/rails-1,baerjam/rails,mohitnatoo/rails,fabianoleittes/rails,maicher/rails,starknx/rails,vipulnsward/rails,travisofthenorth/rails,Vasfed/rails,schuetzm/rails,samphilipd/rails,matrinox/rails,mathieujobin/reduced-rails-for-travis,flanger001/rails,arunagw/rails,Vasfed/rails,travisofthenorth/rails,tjschuck/rails,Erol/rails,printercu/rails,vipulnsward/rails,printercu/rails,Sen-Zhang/rails,kmayer/rails,rossta/rails,esparta/rails,mtsmfm/railstest,iainbeeston/rails,richseviora/rails,odedniv/rails,deraru/rails,kachick/rails,rails/rails,rbhitchcock/rails,lcreid/rails,elfassy/rails,fabianoleittes/rails,kddeisz/rails,tjschuck/rails,esparta/rails,sergey-alekseev/rails,odedniv/rails,tjschuck/rails,tgxworld/rails,MichaelSp/rails,gauravtiwari/rails,palkan/rails,illacceptanything/illacceptanything,kachick/rails,Envek/rails,EmmaB/rails-1,yahonda/rails,BlakeWilliams/rails,yawboakye/rails,odedniv/rails,gfvcastro/rails,gcourtemanche/rails,mechanicles/rails,BlakeWilliams/rails,rossta/rails,Stellenticket/rails,coreyward/rails,illacceptanything/illacceptanything,yhirano55/rails,assain/rails,kamipo/rails,georgeclaghorn/rails,untidy-hair/rails,pvalena/rails,gavingmiller/rails,utilum/rails,joonyou/rails,koic/rails,untidy-hair/rails,mtsmfm/railstest,eileencodes/rails,bradleypriest/rails,arunagw/rails,xlymian/rails,aditya-kapoor/rails,amoody2108/TechForJustice,sealocal/rails,bogdanvlviv/rails,assain/rails,kaspth/rails,fabianoleittes/rails,coreyward/rails,tgxworld/rails,MichaelSp/rails,flanger001/rails,lucasmazza/rails,yalab/rails,assain/rails,mathieujobin/reduced-rails-for-travis,Envek/rails,stefanmb/rails,kmcphillips/rails,rails/rails,repinel/rails,betesh/rails,MSP-Greg/rails,kmcphillips/rails,illacceptanything/illacceptanything,illacceptanything/illacceptanything,illacceptanything/illacceptanything,Envek/rails,eileencodes/rails,jeremy/rails,illacceptanything/illacceptanything,illacceptanything/illacceptanything,xlymian/rails,esparta/rails,stefanmb/rails,gauravtiwari/rails,koic/rails,bolek/rails,Vasfed/rails,kmcphillips/rails,aditya-kapoor/rails,kddeisz/rails,BlakeWilliams/rails,repinel/rails,Edouard-chin/rails,illacceptanything/illacceptanything,joonyou/rails,tijwelch/rails,lcreid/rails