fix(security): Use crypto.getRandomValues instead of Math.random (#40)

`Math.random` should not be used for cryptographic purposes.
This commit is contained in:
Aaron Dewes 2024-08-22 16:57:46 +02:00 committed by GitHub
commit c10bb032fd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -293,10 +293,9 @@ new Vue({
}, },
generateKeys: function () { generateKeys: function () {
var self = this var self = this
const genRanHex = size => const genRandomHexBytes = size =>
[...Array(size)] crypto.getRandomValues(new Uint8Array(size))
.map(() => Math.floor(Math.random() * 16).toString(16)) .reduce((acc, i) => acc + i.toString(16).padStart(2, '0'), '')
.join('')
debugcard = debugcard =
typeof this.cardDialog.data.card_name === 'string' && typeof this.cardDialog.data.card_name === 'string' &&
@ -304,15 +303,15 @@ new Vue({
self.cardDialog.data.k0 = debugcard self.cardDialog.data.k0 = debugcard
? '11111111111111111111111111111111' ? '11111111111111111111111111111111'
: genRanHex(32) : genRandomHexBytes(16)
self.cardDialog.data.k1 = debugcard self.cardDialog.data.k1 = debugcard
? '22222222222222222222222222222222' ? '22222222222222222222222222222222'
: genRanHex(32) : genRandomHexBytes(16)
self.cardDialog.data.k2 = debugcard self.cardDialog.data.k2 = debugcard
? '33333333333333333333333333333333' ? '33333333333333333333333333333333'
: genRanHex(32) : genRandomHexBytes(16)
}, },
closeFormDialog: function () { closeFormDialog: function () {
this.cardDialog.data = {} this.cardDialog.data = {}