Use constant time string comparison in FormKey validator

Author: p0pr0ck5

lib/internal/Magento/Framework/Data/Form/FormKey/Validator.php

@@ -5,6 +5,11 @@
  */
 namespace Magento\Framework\Data\Form\FormKey;
 
+use Magento\Framework\Encryption\Helper\Security;
+
+/**
+ * @api
+ */
 class Validator
 {
     /**
@@ -29,9 +34,11 @@ public function __construct(\Magento\Framework\Data\Form\FormKey $formKey)
     public function validate(\Magento\Framework\App\RequestInterface $request)
     {
         $formKey = $request->getParam('form_key', null);
-        if (!$formKey || $formKey !== $this->_formKey->getFormKey()) {
+
+        if (!$formKey) {
             return false;
         }
-        return true;
+
+        return Security::compareStrings($formKey, $this->_formKey->getFormKey());
     }
 }