package com.thoughtworks.securityinourdna;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import java.sql.SQLException;

@RestController
public class VendorPortalController {

    private final UserRepo userRepo;

    @Autowired
    public VendorPortalController(UserRepo userRepo) {
        this.userRepo = userRepo;
    }

    @RequestMapping(value = "/vendor/delete/{name}", method = RequestMethod.POST)
    public String deleteVendor(@PathVariable String name,
                               @RequestParam String csrfToken,
                               HttpServletRequest request,
                               HttpSession session) throws SQLException {
        if (loggedIn(session) && csrfTokenCorrect(csrfToken, request.getCookies())) {
            userRepo.delete(name);
            return name;
        }

        throw new UnauthorizedResponse();
    }

    private boolean loggedIn(HttpSession session) {
        final UserState userState = (UserState) session.getAttribute("userState");
        return userState != null && userState.isLoggedIn();
    }

    private boolean csrfTokenCorrect(String csrfToken, Cookie[] cookies) {
        String csrfTokenFromCookie = null;
        for (Cookie cookie : cookies) {
            if (cookie.getName().equals("csrfToken")) {
                csrfTokenFromCookie = cookie.getValue();
            }
        }

        if (csrfTokenFromCookie == null) {
            return false;
        } else {
            return constantTimeEquals(csrfTokenFromCookie, csrfToken);
        }
    }

    /*
     * http://codahale.com/a-lesson-in-timing-attacks/
     */
    private boolean constantTimeEquals(String a, String b) {
        byte[] byteArrayA = a.getBytes();
        byte[] byteArrayB = b.getBytes();
        
        if (byteArrayA.length != byteArrayB.length) {
            return false;
        }

        int result = 0;
        for (int i = 0; i < byteArrayA.length; i++) {
            result |= byteArrayA[i] ^ byteArrayB[i];
        }
        return result == 0;
    }

}

@@ -155,42 +155,8 @@
 *;%0A%0A
-import javax.servlet.http.Cookie;%0A
 impo
@@ -197,16 +197,16 @@
 equest;%0A
+
 import j
@@ -840,61 +840,8 @@
 ion)
- && csrfTokenCorrect(csrfToken, request.getCookies())
 ) %7B%0A
@@ -1159,974 +1159,12 @@
 ();%0A
+
     %7D%0A
-%0A    private boolean csrfTokenCorrect(String csrfToken, Cookie%5B%5D cookies) %7B%0A        String csrfTokenFromCookie = null;%0A        for (Cookie cookie : cookies) %7B%0A            if (cookie.getName().equals(%22csrfToken%22)) %7B%0A                csrfTokenFromCookie = cookie.getValue();%0A            %7D%0A        %7D%0A%0A        if (csrfTokenFromCookie == null) %7B%0A            return false;%0A        %7D else %7B%0A            return constantTimeEquals(csrfTokenFromCookie, csrfToken);%0A        %7D%0A    %7D%0A%0A    /*%0A     * http://codahale.com/a-lesson-in-timing-attacks/%0A     */%0A    private boolean constantTimeEquals(String a, String b) %7B%0A        byte%5B%5D byteArrayA = a.getBytes();%0A        byte%5B%5D byteArrayB = b.getBytes();%0A        %0A        if (byteArrayA.length != byteArrayB.length) %7B%0A            return false;%0A        %7D%0A%0A        int result = 0;%0A        for (int i = 0; i %3C byteArrayA.length; i++) %7B%0A            result %7C= byteArrayA%5Bi%5D %5E byteArrayB%5Bi%5D;%0A        %7D%0A        return result == 0;%0A    %7D%0A%0A
 %7D%0A

remove solution, no cheating don't look :)