Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace math/rand usage with crypto/rand #39

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ChrisRx
Copy link

@ChrisRx ChrisRx commented Aug 28, 2020

This replaces the usage of math/rand with crypto/rand to support downstream usages of the random package that have security implications, such as the csrf middleware.

I don't see it used a lot of places, the only place outside of the csrf middleware appears to be the request_id middleware. If it makes more sense to ensure performance for non-crypographic usage of this package (which request_id middleware appears to be), I can create a second type and constructor for SecureRandom that uses the crypto/rand source, leaving the existing behavior for the Random type. Just let me know what you prefer.

This replaces the usage of math/rand with crypto/rand to support
downstream usages of the random package that have security implications,
such as the csrf middleware.
@ChrisRx ChrisRx closed this Aug 28, 2020
@ChrisRx ChrisRx reopened this Aug 28, 2020
@codecov-commenter
Copy link

codecov-commenter commented Aug 28, 2020

Codecov Report

Merging #39 into master will decrease coverage by 0.14%.
The diff coverage is 75.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master      #39      +/-   ##
==========================================
- Coverage   59.26%   59.11%   -0.15%     
==========================================
  Files           6        6              
  Lines         518      521       +3     
==========================================
+ Hits          307      308       +1     
- Misses        208      209       +1     
- Partials        3        4       +1     
Impacted Files Coverage Δ
random/random.go 87.50% <75.00%> (-12.50%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4919956...57f6fdb. Read the comment docs.

@ChrisRx
Copy link
Author

ChrisRx commented Oct 17, 2020

I tried to make codecov happy locally, however, I think the difference it calculates in coverage is unavoidable. I think it is mistaken about the error being handled for the call to ReadByte(), because I believe the only safe thing to do should it return any error is for the program to crash. Is there anything that I need to do to help get this merged in?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants