Use constant-time comparison for cryptographic byte arrays

Proprietary

Use MessageDigest.isEqual(byte[], byte[]) when program analysis proves that a digest or MAC output flows into Arrays.equals(byte[], byte[]). Other comparisons are preserved.

org.openrewrite.java.security.UseConstantTimeCryptographicComparison

mod run . --recipe=org.openrewrite.java.security.UseConstantTimeCryptographicComparison

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.