Commit ad75c78
doc: add note about timingSafeEqual for TypedArray
PR-URL: #36323
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>1 parent 27260c7 commit ad75c78
1 file changed
Lines changed: 5 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -3383,7 +3383,11 @@ comparing HMAC digests or secret values like authentication cookies or | |||
| 3383 | 3383 | [capability urls](https://www.w3.org/TR/capability-urls/). | |
| 3384 | 3384 | ||
| 3385 | 3385 | `a` and `b` must both be `Buffer`s, `TypedArray`s, or `DataView`s, and they | |
| 3386 | - must have the same length. | ||
| 3386 | + must have the same byte length. | ||
| 3387 | + | ||
| 3388 | + If at least one of `a` and `b` is a `TypedArray` with more than one byte per | ||
| 3389 | + entry, such as `Uint16Array`, the result will be computed using the platform | ||
| 3390 | + byte order. | ||
| 3387 | 3391 | ||
| 3388 | 3392 | Use of `crypto.timingSafeEqual` does not guarantee that the *surrounding* code | |
| 3389 | 3393 | is timing-safe. Care should be taken to ensure that the surrounding code does | |
0 commit comments