Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

node.js SECURITY VULN: claims to use crypto, but uses Math.random() #122

Closed
coolaj86 opened this issue Nov 7, 2015 · 1 comment
Closed

Comments

@coolaj86
Copy link
Contributor

coolaj86 commented Nov 7, 2015

I've tested this on io.js v1.6.3 and node.js v5.0.0.

Tested with npm install node-uuid@latest

Discovered this after posting a joke on twitter and then decided to actually try replacing Math.random() with an error-throwing function to as part of a security audit on my software and its modules.

This module uses Math.random() because testing the availability of crypto fails.

console.log(typeof(_global.require) == 'function');
false

Should be 'function' === typeof require, pull requesting....

@coolaj86 coolaj86 changed the title node.js SECURITY VULN: false === typeof(_global.require) == 'function') node.js SECURITY VULN: claims to use crypto, but uses Math.random() Nov 7, 2015
@coolaj86
Copy link
Contributor Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant