fix(nms): Fix insecure randomness

[spikey979]

Signed-off-by: Kristijan spikey979@gmail.com

fix(nms): Fix insecure randomness

Summary

Using a cryptographically weak pseudo-random number generator to generate a security-sensitive value, such as a password, makes it easier for an attacker to predict the value. A cryptographically secure pseudo-random number generator should be used instead.

Additional Information

This is for code scanning alerts:
https://github.com/magma/magma/security/code-scanning/62
https://github.com/magma/magma/security/code-scanning/63
https://github.com/magma/magma/security/code-scanning/64
https://github.com/magma/magma/security/code-scanning/65

[github-actions]

Thanks for opening a PR! 💯

A couple initial guidelines

• All commits must be signed off. This is enforced by DCO check.
• All PR titles must follow the semantic commits format. This is enforced by Semantic PR.

Howto

• Reviews. The "Reviewers" listed for this PR are the Magma maintainers who will shepherd it.
• Checks. All required CI checks must pass before merge.
• Merge. Once approved and passing CI checks, use the ready2merge label to indicate the maintainers can merge your PR.

More info

Please take a moment to read through the Magma project's

• Contributing Conventions for norms around contributed code

If this is your first Magma PR, also consider reading

• Developer Onboarding for onboarding as a new Magma developer
• Development Workflow for guidance on your first pull request
• CI Checks for points of contact for failing or flaky CI checks
• GitHub-to-Slack mappings for Magma maintainers for guidance on how to contact maintainers on Slack

[github-actions]

nms-workflow

0 files  0 suites   0s ⏱️
0 tests 0 ✔️ 0 💤 0 ❌

Results for commit d6544fd.

♻️ This comment has been updated with latest results.

[thmsschmitt]

The server runs in node. You need to use https://nodejs.org/api/crypto.html instead.

[spikey979]

The server runs in node. You need to use https://nodejs.org/api/crypto.html instead.

If I use crypto.getRandomValues() without "winodw", in CI tests I get error: Cannot resolve name crypto. [cannot-resolve-name]

[thmsschmitt]

You need to import it:

import crypto from 'crypto';

also note that it has a different API then window.crypto. See https://nodejs.org/api/crypto.html

[thmsschmitt]

Sorry that this takes so long.

crypto.getRandomValues is only available since node v17.4.0 and we are using v16.14. Also only using 4 bytes isn't great.

I suggest we use something like
crypto.randomBytes(16).toString('hex')

[spikey979]

@thmsschmitt thanks for helping

[thmsschmitt]

@spikey979 I'm waiting for the ready2merge label. It would also be good to rebase this once more.