From 7a14a96b834dd283a4e41a58d17b653d968fec86 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza Date: Mon, 6 Jul 2026 02:09:46 -0300 Subject: [PATCH] fix(security): crypto-backed randomNumericId in doubao-web (CodeQL js/insecure-randomness) The synthetic Dola device/web id was built from Math.random; CodeQL flags it as insecure randomness in a security context. Not a secret, but crypto.getRandomValues costs the same and closes alert #692 at the source. Doubao executor tests 14/14 green. Alerts #693-695 (incomplete-url-substring in unit-test asserts) dismissed as false positives per the v3.8.35 precedent (Hard Rule #14). --- open-sse/executors/doubao-web.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/open-sse/executors/doubao-web.ts b/open-sse/executors/doubao-web.ts index 10a9e395ea..c781834042 100644 --- a/open-sse/executors/doubao-web.ts +++ b/open-sse/executors/doubao-web.ts @@ -48,8 +48,11 @@ function parseJsonRecord(raw: string): JsonRecord | null { } function randomNumericId(length = 19): string { - let id = String(Math.floor(Math.random() * 9) + 1); - while (id.length < length) id += String(Math.floor(Math.random() * 10)); + // crypto-backed (CodeQL js/insecure-randomness): a synthetic device/web id, + // not a secret — but crypto.getRandomValues costs the same and closes the alert. + const bytes = globalThis.crypto.getRandomValues(new Uint8Array(length)); + let id = String((bytes[0] % 9) + 1); + for (let i = 1; i < length; i += 1) id += String(bytes[i] % 10); return id; }