aiolabs/boltcards
9
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): Use crypto.getRandomValues instead of Math.random (#40)

Browse source 
`Math.random` should not be used for cryptographic purposes.
This commit is contained in:
Aaron Dewes 2024-08-22 16:57:46 +02:00 • committed by GitHub
commit c10bb032fd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
static/js/index.js
View file

@ -293,10 +293,9 @@ new Vue({
},
generateKeys: function () {
var self = this
const genRanHex = size =>
[...Array(size)]
.map(() => Math.floor(Math.random() * 16).toString(16))
.join('')
const genRandomHexBytes = size =>
crypto.getRandomValues(new Uint8Array(size))
.reduce((acc, i) => acc + i.toString(16).padStart(2, '0'), '')
debugcard =
typeof this.cardDialog.data.card_name === 'string' &&
@ -304,15 +303,15 @@ new Vue({
self.cardDialog.data.k0 = debugcard
? '11111111111111111111111111111111'
: genRanHex(32)
: genRandomHexBytes(16)
self.cardDialog.data.k1 = debugcard
? '22222222222222222222222222222222'
: genRanHex(32)
: genRandomHexBytes(16)
self.cardDialog.data.k2 = debugcard
? '33333333333333333333333333333333'
: genRanHex(32)
: genRandomHexBytes(16)
},
closeFormDialog: function () {
this.cardDialog.data = {}