Audit the random number generation source (rand) GSC-G404
Use of weak random number generator (math/rand instead of crypto/rand)
326 if opts.Name != nil {
327 ro.Params["name"] = *opts.Name
328 } else {
329 ro.Params["name"] = fmt.Sprintf("%s-%d", kind, (rand.Intn(8999) + 1000))330 }
331
332 if opts.Parameters != nil {Use of weak random number generator (math/rand instead of crypto/rand)
180 return nil, fmt.Errorf("parameter required: Url")
181 }
182
183 key := fmt.Sprintf("%s-%d", url, rand.Int63())184 name := common.DefaultString(opts.Name, fmt.Sprintf("webhook-%s", fmt.Sprintf("%x", sha256.Sum256([]byte(key)))[0:6]))
185
186 if err := p.webhookCreate(name, url); err != nil {Use of weak random number generator (math/rand instead of crypto/rand)
31
32 // if pid is a service name, pick one at random
33 if len(pss) > 0 {
34 pid = pss[rand.Intn(len(pss))].Id 35 }
36
37 req := p.Cluster.CoreV1().RESTClient().Post().Resource("pods").Name(pid).Namespace(p.AppNamespace(app)).SubResource("exec").Param("container", app)Use of weak random number generator (math/rand instead of crypto/rand)
7func id(prefix string, size int) string {
8 b := make([]rune, size)
9 for i := range b {
10 b[i] = alphabet[rand.Intn(len(alphabet))]11 }
12 return prefix + string(b)
13}Use of weak random number generator (math/rand instead of crypto/rand)
120 s.subscriptions[stream] = map[string]*subscription{}
121 }
122
123 handle := fmt.Sprintf("%v:%d", ch, rand.Int63())124
125 s.subscriptions[stream][handle] = &subscription{ch: ch, start: start}
126
Description
math/rand is much faster for applications that don’t need crypto-level or security-related random data generation. crypto/rand is suited for secure and crypto-ready usage, but it’s slower. But in most cases, crypto/rand is likely to be more suitable, unless the performance is critical but the application's security is not (which is rare).
It is highly recommended to use crypto/rand when needing to be secure with random numbers such as generating session ID in a web application.
- crypto/rand package
- math/rand package
Bad practice
package main
import "math/rand"
func main() {
bad := rand.Int()
println(bad)
}
Recommended
package main
import "crypto/rand"
func main() {
good, _ := rand.Read(nil)
println(good)
}