🐛 constant-time HMAC security fix

Author: ianardee

src/main/java/com/mindee/parsing/BaseLocalResponse.java

@@ -9,6 +9,7 @@
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.security.InvalidKeyException;
+import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -103,6 +104,14 @@ public String getHmacSignature(String secretKey) {
    * @return true if the signatures match.
    */
   public boolean isValidHmacSignature(String secretKey, String signature) {
-    return signature.equals(getHmacSignature(secretKey));
+    if (signature == null || secretKey == null) {
+      return false;
+    }
+    byte[] expectedBytes = getHmacSignature(secretKey).getBytes(StandardCharsets.UTF_8);
+    byte[] actualBytes = signature
+      .toLowerCase(java.util.Locale.ROOT)
+      .getBytes(StandardCharsets.UTF_8);
+
+    return MessageDigest.isEqual(expectedBytes, actualBytes);
   }
 }