Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Securely implement UUIDGen for Scala.js #2945

Merged
merged 2 commits into from Apr 5, 2022

Conversation

armanbilge
Copy link
Member

This PR relates to CVE-2022-28355 aka GHSA-j2f9-w8wh-9ww4 regarding the insecure implementation of java.util.UUID.randomUUID() in Scala.js.

The fix implemented by Scala.js was to re-implement java.util.UUID.randomUUID() in terms of java.security.SecureRandom, and then make two SecureRandom artifacts available:

Although depending on the fake artifact is strongly discouraged, it's still out there. After discussing with @cquiroz, given the lack of failure mode and non-determinism should both artifacts somehow end up on the classpath, it seems the safest thing to do is avoid using either of these in Cats Effect and instead rely on our own secure implementation.

This is reminiscent of the situation with the two weak reference libs, in which we decided to shade the "true" implementation within CE in #2673 (comment).

This PR does two things:

  1. Replace the JavaSecureRandom from Implement Random#javaSecuritySecureRandom on Scala.js #2906 with the implementation from https://github.com/scala-js/scala-js-java-securerandom
  2. Implement UUIDGen on Scala.js by inlining the changes from Fix #4657: Implement UUID.randomUUID() using java.security.SecureRandom. scala-js/scala-js#4659 using our internal JavaSecureRandom

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants