From 0d82ad962317a943e45ee20a3f564027b001f19e Mon Sep 17 00:00:00 2001
From: John Beynon <johnb@heroku.com>
Date: Fri, 8 Dec 2017 10:52:59 +0000
Subject: [PATCH 1/2] Use a time based comparison

---
 server.coffee | 2 +-
 server.js     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/server.coffee b/server.coffee
index 2af6f6f..bf1e114 100644
--- a/server.coffee
+++ b/server.coffee
@@ -256,7 +256,7 @@ server = Http.createServer (req, resp) ->
 
       hmac_digest = hmac.digest('hex')
 
-      if hmac_digest == query_digest
+      if Crypto.timingSafeEqual(Buffer.from(hmac_digest), Buffer.from(query_digest))
         url = Url.parse dest_url
 
         process_url url, transferredHeaders, resp, max_redirects
diff --git a/server.js b/server.js
index 27621b9..652c133 100644
--- a/server.js
+++ b/server.js
@@ -1,4 +1,4 @@
-// Generated by CoffeeScript 1.12.6
+// Generated by CoffeeScript 1.12.7
 (function() {
   var Crypto, Fs, Http, Https, Path, QueryString, Url, accepted_image_mime_types, camo_hostname, content_length_limit, current_connections, debug_log, default_security_headers, error_log, finish, four_oh_four, hexdec, keep_alive, logging_enabled, max_redirects, port, process_url, server, shared_key, socket_timeout, started_at, total_connections, version,
     indexOf = [].indexOf || function(item) { for (var i = 0, l = this.length; i < l; i++) { if (i in this && this[i] === item) return i; } return -1; };
@@ -293,7 +293,7 @@
           return four_oh_four(resp, "could not create checksum");
         }
         hmac_digest = hmac.digest('hex');
-        if (hmac_digest === query_digest) {
+        if (Crypto.timingSafeEqual(Buffer.from(hmac_digest), Buffer.from(query_digest))) {
           url = Url.parse(dest_url);
           return process_url(url, transferredHeaders, resp, max_redirects);
         } else {

From 0b5a27b389c5505c9404ee4c82a1f094b8b38e6e Mon Sep 17 00:00:00 2001
From: John Beynon <johnb@heroku.com>
Date: Thu, 21 Dec 2017 11:55:24 +0000
Subject: [PATCH 2/2] Catch TypeErrors

---
 server.coffee | 18 ++++++++++++------
 server.js     | 21 +++++++++++++++------
 2 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/server.coffee b/server.coffee
index bf1e114..d41b270 100644
--- a/server.coffee
+++ b/server.coffee
@@ -256,12 +256,18 @@ server = Http.createServer (req, resp) ->
 
       hmac_digest = hmac.digest('hex')
 
-      if Crypto.timingSafeEqual(Buffer.from(hmac_digest), Buffer.from(query_digest))
-        url = Url.parse dest_url
-
-        process_url url, transferredHeaders, resp, max_redirects
-      else
-        four_oh_four(resp, "checksum mismatch #{hmac_digest}:#{query_digest}")
+      try 
+        if Crypto.timingSafeEqual(Buffer.from(hmac_digest), Buffer.from(query_digest))
+          url = Url.parse dest_url
+          process_url url, transferredHeaders, resp, max_redirects
+        else
+          four_oh_four(resp, "checksum mismatch #{hmac_digest}:#{query_digest}")
+      catch e 
+        if e instanceof TypeError
+          return four_oh_four(resp, "could not compare checksum") 
+        else
+          throw e
+      
     else
       four_oh_four(resp, "No pathname provided on the server")
 
diff --git a/server.js b/server.js
index 652c133..0b0ff5c 100644
--- a/server.js
+++ b/server.js
@@ -240,7 +240,7 @@
   };
 
   server = Http.createServer(function(req, resp) {
-    var base, dest_url, encoded_url, error, hmac, hmac_digest, query_digest, ref, ref1, ref2, transferredHeaders, url, url_type, user_agent;
+    var base, dest_url, e, encoded_url, error, hmac, hmac_digest, query_digest, ref, ref1, ref2, transferredHeaders, url, url_type, user_agent;
     if (req.method !== 'GET' || req.url === '/') {
       resp.writeHead(200, default_security_headers);
       return resp.end('hwhat');
@@ -293,11 +293,20 @@
           return four_oh_four(resp, "could not create checksum");
         }
         hmac_digest = hmac.digest('hex');
-        if (Crypto.timingSafeEqual(Buffer.from(hmac_digest), Buffer.from(query_digest))) {
-          url = Url.parse(dest_url);
-          return process_url(url, transferredHeaders, resp, max_redirects);
-        } else {
-          return four_oh_four(resp, "checksum mismatch " + hmac_digest + ":" + query_digest);
+        try {
+          if (Crypto.timingSafeEqual(Buffer.from(hmac_digest), Buffer.from(query_digest))) {
+            url = Url.parse(dest_url);
+            return process_url(url, transferredHeaders, resp, max_redirects);
+          } else {
+            return four_oh_four(resp, "checksum mismatch " + hmac_digest + ":" + query_digest);
+          }
+        } catch (error1) {
+          e = error1;
+          if (e instanceof TypeError) {
+            return four_oh_four(resp, "could not compare checksum");
+          } else {
+            throw e;
+          }
         }
       } else {
         return four_oh_four(resp, "No pathname provided on the server");