Merge pull request #56 from jenkinsci-cert/SECURITY-245

[FIX SECURITY-245] Compare crumbs in constant time

core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java

@@ -5,6 +5,7 @@
  */
 package hudson.security.csrf;
 
+import java.nio.charset.Charset;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.logging.Level;
@@ -95,7 +96,9 @@ public class DefaultCrumbIssuer extends CrumbIssuer {
         if (request instanceof HttpServletRequest) {
             String newCrumb = issueCrumb(request, salt);
             if ((newCrumb != null) && (crumb != null)) {
-                return newCrumb.equals(crumb);
+                // String.equals() is not constant-time, but this is
+                return MessageDigest.isEqual(newCrumb.getBytes(Charset.forName("US-ASCII")),
+                        crumb.getBytes(Charset.forName("US-ASCII")));
             }
         }
         return false;