From 0ade48bd041d2e25c5247b7e8921c3a13d8e2a67 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Date: Thu, 21 May 2026 10:35:24 -0300 Subject: [PATCH] fix(security): replace Math.random with crypto.randomUUID in generateTaskId/ActivityId and fix URL hostname check in test (#2461) (#2489) Co-authored-by: diegosouzapw --- src/lib/cloudAgent/baseAgent.ts | 4 ++-- tests/unit/antigravity-discovery-bootstrap.test.ts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/lib/cloudAgent/baseAgent.ts b/src/lib/cloudAgent/baseAgent.ts index 9f5689b90b..26c2defb59 100644 --- a/src/lib/cloudAgent/baseAgent.ts +++ b/src/lib/cloudAgent/baseAgent.ts @@ -86,10 +86,10 @@ export abstract class CloudAgentBase { } protected generateTaskId(): string { - return `task_${Date.now()}_${Math.random().toString(36).substring(2, 11)}`; + return `task_${Date.now()}_${crypto.randomUUID().replace(/-/g, "").substring(0, 9)}`; } protected generateActivityId(): string { - return `act_${Date.now()}_${Math.random().toString(36).substring(2, 11)}`; + return `act_${Date.now()}_${crypto.randomUUID().replace(/-/g, "").substring(0, 9)}`; } } diff --git a/tests/unit/antigravity-discovery-bootstrap.test.ts b/tests/unit/antigravity-discovery-bootstrap.test.ts index 3d0aa82f98..9f211e65e9 100644 --- a/tests/unit/antigravity-discovery-bootstrap.test.ts +++ b/tests/unit/antigravity-discovery-bootstrap.test.ts @@ -152,7 +152,7 @@ describe("ensureAntigravityProjectAssigned", () => { const mockFetch = async (url: string, _init?: RequestInit): Promise => { hitUrls.push(url); - if (url.includes("daily-cloudcode-pa.googleapis.com")) { + if (new URL(url).hostname === "daily-cloudcode-pa.googleapis.com") { // First URL fails return new Response("not found", { status: 404 }); }