#5898 - Make get_secure_random_string more secure
| Identifier | #5898 |
|---|---|
| Issue type | Trivial issue (does not break functionality) |
| Title | Make get_secure_random_string more secure |
| Status | Completed |
| Tags |
Roadmap: v11 (custom) Type: Security (custom) |
| Handling member | PDStig |
| Version | 11 beta1 |
| Addon | core |
| Description | get_secure_random_string was not, in fact, cryptographically secure because we were converting the random bytes to MD5.
This patch modifies the function in three ways: * We generate a string character-by-character without using hashing. * We use base32 instead of base16 (numbers and lowercase letters, except for 0, 1, l, and o). * A param can be specified to change the length from the original forced 13 bytes. |
| Steps to reproduce | |
| Funded? | No |
| Commits |
The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".


Comments