Skip to content

feat(security): add constant-time string and buffer comparison helpers - #649

Merged
TheVicky1 merged 2 commits into
TheVicky1:mainfrom
akshatXD-hash:feat/security-add-constant-time-string-equality-and-timing-attack-safe-comparator
Oct 24, 2026
Merged

TheVicky1 merged 2 commits into
TheVicky1:mainfrom
akshatXD-hash:feat/security-add-constant-time-string-equality-and-timing-attack-safe-comparator

Conversation

@akshatXD-hash

Copy link
Copy Markdown
Contributor

Closes #639

Adds src/lib/security/constant-time.ts with:

  • constantTimeEqual: optional NFC normalization, UTF-8 encoding, and XOR comparison.
  • timingSafeBufferEqual: full-buffer comparison with dummy-buffer handling for unequal lengths.
  • timingSafeSelect: bitmask-based string selection.
  • TypeScript types and JSDoc documentation.

Adds 49 Vitest tests covering equality, mismatches, unequal lengths, empty inputs, Unicode, buffer views, selection, and continued byte reads after mismatches. Integrates the suite into npm test.

Validation:

  • All 96 test suites passed.
  • New module achieved 100% branch, statement, function, and line coverage.
  • Typecheck and secret scan passed.
  • Lint completed with no errors; one warning in generated coverage output.
  • No runtime dependencies added.

Security limitation:
These helpers avoid mismatch-based early exits, but JavaScript execution, normalization, allocation, and observable lengths prevent a strict constant-time guarantee. This limitation is documented.

@vercel

vercel Bot commented Oct 21, 2026

Copy link
Copy Markdown

@akshatXD-hash is attempting to deploy a commit to the Vicky's projects Team on Vercel.

A member of the Team first needs to authorize it.

@github-actions

Copy link
Copy Markdown

👋 Welcome to PACT OS, @akshatXD-hash! 🚀

Thank you for taking the time to open your first pull request on PACT! We are thrilled to have you here in our open-source community.


🔍 What Happens Next?

  1. Automated Verification: Our Continuous Integration (CI) workflow is currently verifying:
    • 🔒 Zero-Secret Security Scan
    • 🔗 Markdown Link Integrity
    • 🧹 ESLint Code Quality
    • 🏷️ TypeScript Strict Typecheck
    • 🧪 56-Suite Automated Domain & Security Test Matrix
    • 🏗️ Next.js Production Build
  2. Maintainer Review: A maintainer (@TheVicky1) will review your pull request shortly.
  3. Friendly Iteration: If any adjustments or feedback are needed, we will provide clear, actionable suggestions to help get your PR merged smoothly.

📚 Helpful Quick Links

Thank you for helping make PACT better! Plan. Track. Improve. Repeat. 🏛️✨

@TheVicky1

Copy link
Copy Markdown
Owner

Hey @akshatXD-hash ,

There are some merge conflict kindly fix it and raise a new PR

@akshatXD-hash

Copy link
Copy Markdown
Contributor Author

I’ve opened PR #649 for this issue and resolved the merge conflicts with main. It’s ready for review.

@TheVicky1
TheVicky1 merged commit 60d7222 into TheVicky1:main Oct 24, 2026
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Add Constant-Time String Equality & Timing-Attack Safe Comparator in src/lib/security/constant-time.ts

2 participants