From 87cc820985d3a8c79222c773a760369b158bc329 Mon Sep 17 00:00:00 2001
From: Dennis Richter <richterdennis@users.noreply.github.com>
Date: Wed, 29 Nov 2017 15:54:23 +0100
Subject: [PATCH] Improve safeStringCompare to a much faster way (using xor)

---
 src/bcrypt.js | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/src/bcrypt.js b/src/bcrypt.js
index 11dedc1..bd043df 100644
--- a/src/bcrypt.js
+++ b/src/bcrypt.js
@@ -198,18 +198,11 @@ bcrypt.hash = function(s, salt, callback, progressCallback) {
  * @inner
  */
 function safeStringCompare(known, unknown) {
-    var right = 0,
-        wrong = 0;
-    for (var i=0, k=known.length; i<k; ++i) {
-        if (known.charCodeAt(i) === unknown.charCodeAt(i))
-            ++right;
-        else
-            ++wrong;
+    var diff = known.length ^ unknown.length;
+    for (var i=0, i<known.length; ++i) {
+        diff |= known.charCodeAt(i) ^ unknown.charCodeAt(i);
     }
-    // Prevent removal of unused variables (never true, actually)
-    if (right < 0)
-        return false;
-    return wrong === 0;
+    return diff === 0;
 }
 
 /**