Mercurial > p > roundup > code
view roundup/anypy/random_.py @ 8356:63390dcfcfe9
bug: fix template use of structure with untrusted data
Looks like an xSS bug with an early version of the template that was
fixed in the code but never in the deployed tracker. It has been a
while since this particular construct has been in the classic template
which is the base for the tracker.
This has been fixed on the deployed tracker as well.
reported by 4bug of ChaMd5 Security Team H1 Group
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 08 Jul 2025 10:23:09 -0400 |
| parents | f002747b6773 |
| children |
line wrap: on
line source
# ruff: noqa: ARG001 try: from secrets import choice, randbelow, token_bytes def seed(v=None): pass is_weak = False except ImportError: import os as _os import random as _random # prefer to use SystemRandom if it is available if hasattr(_random, 'SystemRandom'): def seed(v=None): pass _r = _random.SystemRandom() is_weak = False else: # don't completely throw away the existing state, but add some # more random state to the existing state def seed(v=None): # ruff: noqa: PLC0415 import os import time _r.seed((_r.getstate(), v, hasattr(os, 'getpid') and os.getpid(), time.time())) # create our own instance so we don't mess with the global # random number generator _r = _random.Random() seed() is_weak = True choice = _r.choice def randbelow(i): return _r.randint(0, i - 1) if hasattr(_os, 'urandom'): def token_bytes(size): return _os.urandom(size) else: def token_bytes(size): _bchr = chr if str is bytes else lambda x: bytes((x,)) return b''.join([_bchr(_r.getrandbits(8)) for i in range(size)])
