[CRITICAL] Unsafe fallback to Math.random

[joepie91]

This is a critical issue, compromising the security of this module.

In this part of the code, this module will fall back to Math.random, regardless of the environment.

This is unsafe, as the crypto module may not always be available in Node.js environments - Node.js may have been compiled without OpenSSL, or a past or future version of Node.js may be used that does not carry the module. In this case, it will silently fall back to poor-quality random data.

The correct behaviour in non-browser environments would be to throw an error, and refuse to continue, if no 'safe' random source can be obtained, and to let the system administrator fix their environment.

Ideally, in browser environments, it would be allowed to fall back to Math.random, but only if an allowUnsafe (or similar) flag were specified on usage. This means the behaviour is safe by default, but can still be run unsafely if old browsers absolutely must be supported, and cryptographically secure UUIDs are not required.

EDIT: Apparently the crypto usage is broken in all cases? Per #108.

[joepie91]

This module should be considered completely broken and insecure until this issue is resolved.

My current advice would be to use the defunctzombie fork (on npm as uuid) instead of this module (which is on npm as node-uuid). It does not suffer from this issue.

[coolaj86]

fixed