[SECURITY-245] Use US-ASCII to prevent charset issues

core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java

@@ -5,6 +5,7 @@
  */
 package hudson.security.csrf;
 
+import java.nio.charset.Charset;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.logging.Level;
@@ -96,7 +97,8 @@ public class DefaultCrumbIssuer extends CrumbIssuer {
             String newCrumb = issueCrumb(request, salt);
             if ((newCrumb != null) && (crumb != null)) {
                 // String.equals() is not constant-time, but this is
-                return MessageDigest.isEqual(newCrumb.getBytes(), crumb.getBytes());
+                return MessageDigest.isEqual(newCrumb.getBytes(Charset.forName("US-ASCII")),
+                        crumb.getBytes(Charset.forName("US-ASCII")));
             }
         }
         return false;