v2.23.1 - #1784
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const raw = randomBytes[0]; // 0 … 4 294 967 295 | ||
|
|
||
| // 2. Collapse into a 90 000 000-wide band (0…89 999 999), then shift to 10 000 000…99 999 999 | ||
| const eightDigit = 10_000_000 + (raw % 90_000_000); |
Check failure
Code scanning / CodeQL
Creating biased random numbers from a cryptographically secure source
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the issue, we need to ensure that the random ID generation is unbiased. This can be achieved by discarding values that would introduce bias, as demonstrated in the background example. Specifically, we will discard any random value greater than or equal to the largest multiple of the divisor (90,000,000) that fits within the range of raw (4,294,967,295). This ensures that the modulo operation is applied to a uniformly distributed range.
The fix involves modifying the randomId function to include a loop that discards biased values and only uses unbiased random values for the modulo operation. No new dependencies are required, as the existing crypto.getRandomValues API is sufficient.
| @@ -685,8 +685,14 @@ | ||
| export const randomId = () => { | ||
| // 1. Grab a cryptographically-secure 32-bit random value | ||
| const randomBytes = crypto.getRandomValues(new Uint32Array(1)); | ||
| const raw = randomBytes[0]; // 0 … 4 294 967 295 | ||
| const divisor = 90_000_000; | ||
| const rangeLimit = Math.floor(4_294_967_295 / divisor) * divisor; // Largest multiple of divisor within range | ||
| let raw; | ||
|
|
||
| // 2. Collapse into a 90 000 000-wide band (0…89 999 999), then shift to 10 000 000…99 999 999 | ||
| const eightDigit = 10_000_000 + (raw % 90_000_000); | ||
| // Loop until we get an unbiased random value | ||
| do { | ||
| const randomBytes = crypto.getRandomValues(new Uint32Array(1)); | ||
| raw = randomBytes[0]; | ||
| } while (raw >= rangeLimit); | ||
|
|
||
| // Collapse into a 90 000 000-wide band (0…89 999 999), then shift to 10 000 000…99 999 999 | ||
| const eightDigit = 10_000_000 + (raw % divisor); | ||
|
|
3 participants
Enable widget placement on click in desktop view
Disable signature types not working
Change icon of agreement sign checkbox
Disable Notify on Signature not working
Update dependencies