{"push_id":1127780109,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"31b515619143e44eadd0b73689d3e5453dd30d36","before":"ebce5d07ac20565900cd052c9ca33b286de6fa28","commits":[{"sha":"31b515619143e44eadd0b73689d3e5453dd30d36","author":{"email":"6c68cabc7124e43c9b4d50f86510600f69e74c99@nym.se","name":"Jakob Borg"},"message":"lib/util: Add secure random numbers source (fixes #3178)\n\nThe math/rand package contains lots of convenient functions, for example\nto get an integer in a specified range without running into issues\ncaused by just truncating a number from a different distribution and so\non. But it's insecure, and we use if for things that benefit from being\nmore secure like session IDs, CSRF tokens and API keys.\n\nThis implements a math/rand.Source that reads from crypto/rand.Reader,\nthis bridging the gap between them. It also updates our RandomString to\nuse the new source, thus giving us secure session IDs and CSRF tokens.\n\nSome future work remains:\n\n - Fix API keys by making the generation in the UI use this code as well\n\n - Refactor out these things into an actual random package, and audit\n   our use of randomness everywhere\n\nI'll leave both of those for the future in order to not muddy the waters\non this diff...\n\nGitHub-Pull-Request: https://github.com/syncthing/syncthing/pull/3180","distinct":true,"url":"https://api.github.com/repos/syncthing/syncthing/commits/31b515619143e44eadd0b73689d3e5453dd30d36"}]}
{"actor":{"display_login":"st-review"}}