#1561 Fix timing attacks by comparing hashes in constant time (#1563)

* #1561 Fix timing attacks by comparing hashes in constant time

* #1561 Fix timing attacks in phpBB fallback hashes
- As noted by @games647

src/test/java/fr/xephi/authme/security/HashAlgorithmIntegrationTest.java

@@ -2,6 +2,7 @@ package fr.xephi.authme.security;
 
 import ch.jalu.injector.Injector;
 import ch.jalu.injector.InjectorBuilder;
+import fr.xephi.authme.TestHelper;
 import fr.xephi.authme.security.crypts.Argon2;
 import fr.xephi.authme.security.crypts.EncryptionMethod;
 import fr.xephi.authme.security.crypts.HashedPassword;
@@ -40,6 +41,7 @@ public class HashAlgorithmIntegrationTest {
         given(settings.getProperty(SecuritySettings.PBKDF2_NUMBER_OF_ROUNDS)).willReturn(10_000);
         injector = new InjectorBuilder().addDefaultHandlers("fr.xephi.authme").create();
         injector.register(Settings.class, settings);
+        TestHelper.setupLogger();
     }
 
     @Test

src/test/java/fr/xephi/authme/security/HashUtilsTest.java

@@ -123,4 +123,13 @@ public class HashUtilsTest {
         assertThat(HashUtils.isValidBcryptHash("#2ae5fc78"), equalTo(false));
     }
 
+    @Test
+    public void shouldCompareStrings() {
+        // given / when / then
+        assertThat(HashUtils.isEqual("test", "test"), equalTo(true));
+        assertThat(HashUtils.isEqual("test", "Test"), equalTo(false));
+        assertThat(HashUtils.isEqual("1234", "1234."), equalTo(false));
+        assertThat(HashUtils.isEqual("ພາສາຫວຽດນາມ", "ພາສາຫວຽດນາມ"), equalTo(true));
+        assertThat(HashUtils.isEqual("test", "tëst"), equalTo(false));
+    }
 }