Masking is not cryptographically secure

[danielgrad]

The random number generator used for masking frames is not cryptographically secure:

web_socket_channel/lib/src/copy/web_socket_impl.dart

Line 28 in 3db86bc

final _random = Random();

web_socket_channel/lib/src/copy/web_socket_impl.dart

Lines 508 to 514 in 3db86bc

	final maskBytes = [
	_random.nextInt(256),
	_random.nextInt(256),
	_random.nextInt(256),
	_random.nextInt(256)
	];
	header.setRange(index, index + 4, maskBytes);

This is a security concern (CWE-331), and deviates from RFC 6455 section 10.3:

Clients MUST choose a new masking key for each frame, using an
algorithm that cannot be predicted by end applications that provide
data. For example, each masking could be drawn from a
cryptographically strong random number generator.

[brianquinlan]

This has been fixed in dart:io for over 7 years but it looks like the change never made it here despite the last import being 6 years ago.