pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-01 12:52:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): crypto-backed randomNumericId in doubao-web (CodeQL js/insecure-randomness)

Browse Source 
The synthetic Dola device/web id was built from Math.random; CodeQL flags it
as insecure randomness in a security context. Not a secret, but
crypto.getRandomValues costs the same and closes alert #692 at the source.
Doubao executor tests 14/14 green. Alerts #693-695 (incomplete-url-substring
in unit-test asserts) dismissed as false positives per the v3.8.35 precedent
(Hard Rule #14).
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-07-06 02:09:46 -03:00
parent adede73fe2
commit 7a14a96b83
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
open-sse/executors/doubao-web.ts
View File

@@ -48,8 +48,11 @@ function parseJsonRecord(raw: string): JsonRecord | null {
}
function randomNumericId(length = 19): string {
let id = String(Math.floor(Math.random() * 9) + 1);
while (id.length < length) id += String(Math.floor(Math.random() * 10));
// crypto-backed (CodeQL js/insecure-randomness): a synthetic device/web id,
// not a secret — but crypto.getRandomValues costs the same and closes the alert.
const bytes = globalThis.crypto.getRandomValues(new Uint8Array(length));
let id = String((bytes[0] % 9) + 1);
for (let i = 1; i < length; i += 1) id += String(bytes[i] % 10);
return id;
}