WebP potentially susceptible to timing attacks

Problem/Motivation

ImageStyleDownloadController::deliver() does direct string comparison when checking the derivative token.

$valid &= $request->query->get(IMAGE_DERIVATIVE_TOKEN) === $image_style->getPathToken($image_uri);

Steps to reproduce

I didn't attempt, so I guess this is more theoretical.

Proposed resolution

Use hash_equals() instead of direct string comparison.

Remaining tasks

Use hash_equals() instead of direct string comparison.

User interface changes

None.

API changes

Data model changes

None.