Skip to content

Commit 8dedcc1

Browse files
committed
Use secure RNG if available
Recent browsers come with better RNG, so let's use it for generating password instead of Math.random if available. Signed-off-by: Michal Čihař <michal@cihar.com>
1 parent 671d618 commit 8dedcc1

File tree

1 file changed

+18
-1
lines changed

1 file changed

+18
-1
lines changed

Diff for: js/functions.js

+18-1
Original file line numberDiff line numberDiff line change
@@ -322,11 +322,28 @@ function suggestPassword(passwd_form)
322322
var pwchars = "abcdefhjmnpqrstuvwxyz23456789ABCDEFGHJKLMNPQRSTUVWYXZ";
323323
var passwordlength = 16; // do we want that to be dynamic? no, keep it simple :)
324324
var passwd = passwd_form.generated_pw;
325+
var randomWords = new Int32Array(passwordlength);
326+
325327
passwd.value = '';
326328

329+
// First we're going to try to use a built-in CSPRNG
330+
if (window.crypto && window.crypto.getRandomValues) {
331+
window.crypto.getRandomValues(randomWords);
332+
}
333+
// Because of course IE calls it msCrypto instead of being standard
334+
else if (window.msCrypto && window.msCrypto.getRandomValues) {
335+
window.msCrypto.getRandomValues(randomWords);
336+
} else {
337+
// Fallback to Math.random
338+
for (var i = 0; i < passwordlength; i++) {
339+
randomWords[i] = Math.floor(Math.random() * pwchars.length);
340+
}
341+
}
342+
327343
for (var i = 0; i < passwordlength; i++) {
328-
passwd.value += pwchars.charAt(Math.floor(Math.random() * pwchars.length));
344+
passwd.value += pwchars.charAt(Math.abs(randomWords[i]) % pwchars.length);
329345
}
346+
330347
passwd_form.text_pma_pw.value = passwd.value;
331348
passwd_form.text_pma_pw2.value = passwd.value;
332349
return true;

0 commit comments

Comments
 (0)