From 982dbc92ec50e14d6ba4fddac5e408ed58ddc101 Mon Sep 17 00:00:00 2001 From: Trim21 Date: Sat, 22 Jul 2023 17:00:35 +0800 Subject: [PATCH 1/3] Update util.go --- middleware/util.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/middleware/util.go b/middleware/util.go index 0aa0420fc..aa26434e7 100644 --- a/middleware/util.go +++ b/middleware/util.go @@ -74,6 +74,11 @@ func randomString(length uint8) string { r := make([]byte, length+(length/4)) // perf: avoid read from rand.Reader many times var i uint8 = 0 + // security note: + // we can't just simply do b[i]=randomStringCharset[rb%len(randomStringCharset)], + // len(len(randomStringCharset)) is 52, and rb is [0, 255], 256 = 52 * 4 + 48. + // make possibility of each character not equal. + for { _, err := io.ReadFull(reader, r) if err != nil { From 0014874b02f2120eb23252b0b2de2090abf68c56 Mon Sep 17 00:00:00 2001 From: Trim21 Date: Sat, 22 Jul 2023 17:02:58 +0800 Subject: [PATCH 2/3] update --- middleware/util.go | 1 + 1 file changed, 1 insertion(+) diff --git a/middleware/util.go b/middleware/util.go index aa26434e7..fa10cd1f6 100644 --- a/middleware/util.go +++ b/middleware/util.go @@ -78,6 +78,7 @@ func randomString(length uint8) string { // we can't just simply do b[i]=randomStringCharset[rb%len(randomStringCharset)], // len(len(randomStringCharset)) is 52, and rb is [0, 255], 256 = 52 * 4 + 48. // make possibility of each character not equal. + // so we will have to skip bytes when rb > randomStringMaxByte for { _, err := io.ReadFull(reader, r) From b12202c4481046da804c930bfc7b9c0d3b27c063 Mon Sep 17 00:00:00 2001 From: Trim21 Date: Sat, 22 Jul 2023 17:04:44 +0800 Subject: [PATCH 3/3] update --- middleware/util.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/middleware/util.go b/middleware/util.go index fa10cd1f6..4d2d172fc 100644 --- a/middleware/util.go +++ b/middleware/util.go @@ -77,8 +77,8 @@ func randomString(length uint8) string { // security note: // we can't just simply do b[i]=randomStringCharset[rb%len(randomStringCharset)], // len(len(randomStringCharset)) is 52, and rb is [0, 255], 256 = 52 * 4 + 48. - // make possibility of each character not equal. - // so we will have to skip bytes when rb > randomStringMaxByte + // make the first 48 characters more possibly to be generated then others. + // So we have to skip bytes when rb > randomStringMaxByte for { _, err := io.ReadFull(reader, r)