Skip to content

🛡️ Sentinel: [MEDIUM] Fix insecure randomness in ID generators #2201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nilsreichardt wants to merge 2 commits into
base: main
Choose a base branch
from
+13 −5
Open

🛡️ Sentinel: [MEDIUM] Fix insecure randomness in ID generators #2201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6b9c681
Fix insecure randomness in ID generators
google-labs-jules[bot] Mar 1, 2026
fbe3a58
Fix insecure randomness in ID generators
google-labs-jules[bot] Mar 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
## 2024-05-24 - [Insecure Randomness for Identifiers]

**Vulnerability:** Weak random number generation (`Random()`) used for IDs, secrets, tokens, or security-sensitive identifiers.
**Learning:** `Random()` uses a linear congruential generator or similar PRNG algorithm that can be predicted with enough observations. Attackers can figure out the internal state and guess past or future IDs, leading to potential ID enumeration, session hijacking, or predicting sensitive values.
**Prevention:** Use `Random.secure()` from `dart:math` for generating any ID, token, or security-critical random value.
3 changes: 2 additions & 1 deletion lib/abgabe/abgabe_client_lib/lib/src/models/auto_id_generator.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ class AutoIdGenerator {
static const String alphabet =
'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';

static final Random _random = Random();
// Use Random.secure() to prevent predicting auto-generated IDs
static final Random _random = Random.secure();

/// Automatically Generates a random new Id
static String autoId() {
Expand Down
4 changes: 2 additions & 2 deletions lib/common_domain_models/lib/src/ids/src/id.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,9 @@ class Id {
}

/// Generates a new random [Id] with the given [length] using characters
/// from a-z, A-Z and 0-9.
/// from a-z, A-Z and 0-9. Uses [Random.secure] by default to prevent ID prediction.
static Id generate({int length = 20, Random? random}) {
random ??= Random();
random ??= Random.secure();
const chars =
'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
final id =
Expand Down
6 changes: 4 additions & 2 deletions lib/sharezone_utils/lib/src/random_string/random_string.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@
import 'dart:math';

String randomString(int length) {
var rand = Random();
// Use Random.secure() to prevent predictability of random strings
var rand = Random.secure();

@gemini-code-assist gemini-code-assist Bot Mar 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The rand variable is only assigned once. It's preferable to declare it as final to adhere to the style guide, which promotes immutability for variables that are not reassigned.

Suggested change
var rand = Random.secure();
final rand = Random.secure();
References
  1. The style guide (line 101) states to follow a consistent rule for var and final on local variables. Using final for variables that are not reassigned is a standard Dart convention that aligns with this rule. (link)

var codeUnits = List.generate(length, (index) {
return rand.nextInt(33) + 89;
});
Expand All @@ -18,7 +19,8 @@ String randomString(int length) {
}

String randomIDString(int length) {
var rand = Random();
// Use Random.secure() to prevent predictability of generated IDs
var rand = Random.secure();

@gemini-code-assist gemini-code-assist Bot Mar 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The rand variable is only assigned once. It's preferable to declare it as final to adhere to the style guide, which promotes immutability for variables that are not reassigned.

Suggested change
var rand = Random.secure();
final rand = Random.secure();
References
  1. The style guide (line 101) states to follow a consistent rule for var and final on local variables. Using final for variables that are not reassigned is a standard Dart convention that aligns with this rule. (link)

const chars =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
String result = "";
Expand Down
Loading