Use Binxtils::Secure.compare? for constant-time token checks

binxtils 0.6.0 ships the helper both ControllerHelpers and
BikeServices::ShowCurrentAlerts had their own copy of.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: sethherr

Gemfile.lock

@@ -137,7 +137,7 @@ GEM
     bcrypt (3.1.22)
     benchmark (0.5.0)
     bigdecimal (4.1.2)
-    binxtils (0.5.2)
+    binxtils (0.6.0)
       functionable
       loofah
       rails
@@ -244,7 +244,7 @@ GEM
       dry-logic (~> 1.4)
       zeitwerk (~> 2.6)
     equalizer (0.0.11)
-    erb (6.0.6)
+    erb (6.0.7)
     erubi (1.13.1)
     excon (0.76.0)
     execjs (2.7.0)
@@ -438,7 +438,7 @@ GEM
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     jmespath (1.6.2)
-    json (2.21.1)
+    json (2.21.2)
     jwt (3.2.0)
       base64
     knapsack_pro (10.0.1)
@@ -674,7 +674,7 @@ GEM
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rbs (4.1.0)
+    rbs (4.1.2)
       logger
       prism (>= 1.6.0)
       tsort
@@ -900,7 +900,7 @@ GEM
       nokogiri (~> 1.8)
     yaml (0.4.0)
     yard (0.9.44)
-    zeitwerk (2.8.2)
+    zeitwerk (2.8.3)
 
 PLATFORMS
   arm64-darwin

app/controllers/api/v1/bikes_controller.rb

@@ -80,7 +80,7 @@ def create
 
       def authenticate_organization
         organization = Organization.friendly_find(params[:organization_slug])
-        if organization.present? && secure_compare?(params[:access_token], organization.access_token)
+        if organization.present? && Binxtils::Secure.compare?(params[:access_token], organization.access_token)
           @organization = organization
         else
           render(json: "Not authorized", status: :unauthorized) && return

app/controllers/api/v1/notifications_controller.rb

@@ -27,7 +27,7 @@ def create
       end
 
       def authenticate_notification_permission
-        unless secure_compare?(params[:access_token], ENV["NOTIFICATIONS_API_KEY"])
+        unless Binxtils::Secure.compare?(params[:access_token], ENV["NOTIFICATIONS_API_KEY"])
           render(json: "Not authorized", status: :unauthorized) && return
         end
       end

app/controllers/api/v1/organizations_controller.rb

@@ -12,7 +12,7 @@ def update
         @organization = Organization.friendly_find(params[:id])
         if @organization.blank?
           redirect_to(api_v1_not_found_url) && return
-        elsif secure_compare?(params[:access_token], @organization.access_token)
+        elsif Binxtils::Secure.compare?(params[:access_token], @organization.access_token)
           if Organization.pos_kinds.include?(params[:manual_pos_kind])
             m_kind = (params[:manual_pos_kind] == "no_pos") ? nil : params[:manual_pos_kind]
             # We really only want to update orgs when there is a change, otherwise it breaks where
@@ -37,8 +37,8 @@ def verify_organizations_token
         redirect_to(api_v1_not_found_url) && return unless @organization.present?
 
         if params[:access_token].present?
-          return true if secure_compare?(params[:access_token], ENV["ORGANIZATIONS_API_ACCESS_TOKEN"])
-          return true if secure_compare?(params[:access_token], @organization.access_token)
+          return true if Binxtils::Secure.compare?(params[:access_token], ENV["ORGANIZATIONS_API_ACCESS_TOKEN"])
+          return true if Binxtils::Secure.compare?(params[:access_token], @organization.access_token)
         end
         message = {"401": "Not permitted"}
         respond_with(message, status: :unauthorized) && return

app/controllers/bikes/base_controller.rb

@@ -147,7 +147,7 @@ def assign_bike_stickers(bike_sticker)
 
     def find_token
       # First, deal with claim_token
-      if params[:t].present? && secure_compare?(params[:t], @bike.current_ownership.token)
+      if params[:t].present? && Binxtils::Secure.compare?(params[:t], @bike.current_ownership.token)
         @claim_message = @bike.current_ownership&.claim_message
         session[:claim_token_email] = @bike.current_ownership.owner_email
       end

app/controllers/concerns/controller_helpers.rb

@@ -42,12 +42,6 @@ def forwarded_ip_address
     @forwarded_ip_address ||= IpAddressParser.forwarded_address(request)
   end
 
-  # Constant-time token check. Blank expected returns false, so an unset ENV
-  # token can't match a missing param
-  def secure_compare?(value, expected)
-    expected.present? && ActiveSupport::SecurityUtils.secure_compare(value.to_s, expected)
-  end
-
   def request_location_hash
     @request_location_hash ||= IpAddressParser.location_hash(request)
   end

app/controllers/organized/bulk_imports_controller.rb

@@ -88,11 +88,11 @@ def ensure_can_create_import!
 
       if params[:organization_id] == "ascend"
         @ascend_import = true
-        return true if secure_compare?(request.headers["Authorization"], BulkImport.ascend_api_token)
+        return true if Binxtils::Secure.compare?(request.headers["Authorization"], BulkImport.ascend_api_token)
       else
         ensure_current_organization!
         @current_user = current_organization.auto_user # Crazy override to make current user work
-        return true if secure_compare?(request.headers["Authorization"], current_organization.access_token)
+        return true if Binxtils::Secure.compare?(request.headers["Authorization"], current_organization.access_token)
       end
       render(json: {error: "Not permitted"}, status: 401) && return
     end

app/controllers/register_controller.rb

@@ -115,7 +115,7 @@ def confirm_email
     return redirect_to_current_step if @b_param.email_confirmed?
 
     if @b_param.email_confirmation_token_expired? ||
-        !secure_compare?(params[:confirmation_token], @b_param.email_confirmation_token)
+        !Binxtils::Secure.compare?(params[:confirmation_token], @b_param.email_confirmation_token)
       BikeServices::Register.send_confirmation_email(@b_param)
       flash[:error] = translation(:confirmation_link_expired)
       return redirect_to_current_step

app/controllers/strava_integrations_controller.rb

@@ -28,7 +28,7 @@ def callback
       return
     end
 
-    unless secure_compare?(params[:state], session.delete(:strava_oauth_state))
+    unless Binxtils::Secure.compare?(params[:state], session.delete(:strava_oauth_state))
       flash[:error] = "Invalid OAuth state. Please try again."
       redirect_to return_to
       return

app/controllers/webhooks_controller.rb

@@ -46,7 +46,7 @@ def stripe
   private
 
   def strava_verify_subscription
-    if secure_compare?(params["hub.verify_token"], STRAVA_WEBHOOK_VERIFY_TOKEN)
+    if Binxtils::Secure.compare?(params["hub.verify_token"], STRAVA_WEBHOOK_VERIFY_TOKEN)
       render json: {"hub.challenge" => params["hub.challenge"]}, status: :ok
     else
       head :forbidden