Skip to content
Snippets Groups Projects
  1. Mar 28, 2025
  2. Mar 25, 2025
  3. Mar 24, 2025
  4. Mar 23, 2025
  5. Mar 21, 2025
  6. Mar 14, 2025
  7. Mar 13, 2025
  8. Mar 12, 2025
  9. Mar 04, 2025
  10. Mar 03, 2025
  11. Feb 28, 2025
  12. Feb 27, 2025
  13. Feb 26, 2025
  14. Feb 24, 2025
    • Sjoerd Langkemper's avatar
      [REF] Use random_bytes instead of uniqid/rand for random hex strings · ad240298
      Sjoerd Langkemper authored
      Using random_bytes is both faster and more secure than md5(uniqid(rand(), TRUE)). It is possibly also easier to read, in the sense that it is more obvious that it returns hexadecimal encoded random bytes.
      
      I did not find an instance where guessing the random identifier would result in a security vulnerability. So this change does not have direct security impact as far as I know. It's more of a best practice thing and I hope people copy paste the new, secure way of generating random bytes when creating identifiers for security-sensitive stuff, instead of copying the old, insecure way.
      
      In some test files the lengths of the random strings are one character longer. E.g. I replaced `substr(sha1(rand()), 0, 7)` with `bin2hex(random_bytes(4))`. The length did not seem very important here, so I don't think this matters.
      
      I haven't tested all changed code. I rely on unit tests, and that the code generates a random hex string of a certain length before and after I replaced it.
      
      I also looked into the SQL statements that use MD5(RAND()). These should be replaced by HEX(RANDOM_BYTES()), but this is only available starting in MariaDB 10.10, and we require 10.2.
      ad240298
  15. Feb 19, 2025
  16. Feb 17, 2025
  17. Feb 15, 2025
  18. Feb 13, 2025
  19. Feb 11, 2025
  20. Feb 09, 2025
  21. Feb 07, 2025
Loading