fix(lib): use a cryptographically secure source for async helper ids - #266
Open
mfdebian wants to merge 1 commit into
Open
fix(lib): use a cryptographically secure source for async helper ids#266mfdebian wants to merge 1 commit into
mfdebian wants to merge 1 commit into
Conversation
bjohansebas
reviewed
Aug 9, 2026
| obj.resolve = function resolve (fn) { | ||
| const args = Array.prototype.slice.call(arguments, 1) | ||
| const id = '__' + genId() + '__' | ||
| const id = '__' + randomBytes(10).toString('base64url') + '__' |
Member
There was a problem hiding this comment.
I think we could use the uuid function. The only concern is that it has a longer length than the usual one, and I’m not sure if that could affect things here. At least for session, I avoided using it because the longer key could break more things than I intended. But here, I don’t think anything is stored in a database.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Async helper placeholder ids were being generated with
Math.random(). This change swaps that forcrypto.randomBytes()sinceMath.random()exposed them to being guessable.This carries forward the intent of
361bdd7authored by @dougwilson, who identified the problem and fixed it withuid-safe. I've decided to not useuid-safesince it looks like it's no longer being maintained and Node.js already includes the needed functionality natively (As I learned on my previous PR to Node.js).This was one of 2 leftover cherry picks discussed in #244, for 5ee89a1, this branch already dropped support for Express < 4 but this particular change still needed attention.
Credit for the diagnosis and the fix direction belongs to @dougwilson; only the implementation differs.