From aa23f477b7f66273f7e9551282230386b7de2d8a Mon Sep 17 00:00:00 2001
From: Gusted <williamzijl7@hotmail.com>
Date: Fri, 4 Feb 2022 18:03:15 +0100
Subject: Use `CryptoRandomBytes` instead of `CryptoRandomString` (#18439)

- Switch to use `CryptoRandomBytes` instead of `CryptoRandomString`, OAuth's secrets are copied pasted and don't need to avoid dubious characters etc.
- `CryptoRandomBytes` gives ![2^256 = 1.15 * 10^77](https://render.githubusercontent.com/render/math?math=2^256%20=%201.15%20\cdot%2010^77) `CryptoRandomString` gives ![62^44 = 7.33 * 10^78](https://render.githubusercontent.com/render/math?math=62^44%20=%207.33%20\cdot%2010^78) possible states.
- Add a prefix, such that code scanners can easily grep these in source code.
- 32 Bytes + prefix
---
 modules/secret/secret.go      | 12 ------------
 modules/secret/secret_test.go | 11 -----------
 2 files changed, 23 deletions(-)

(limited to 'modules')

diff --git a/modules/secret/secret.go b/modules/secret/secret.go
index 6b410f2381..e7edc7a95e 100644
--- a/modules/secret/secret.go
+++ b/modules/secret/secret.go
@@ -13,20 +13,8 @@ import (
 	"encoding/hex"
 	"errors"
 	"io"
-
-	"code.gitea.io/gitea/modules/util"
 )
 
-// New creates a new secret
-func New() (string, error) {
-	return NewWithLength(44)
-}
-
-// NewWithLength creates a new secret for a given length
-func NewWithLength(length int64) (string, error) {
-	return util.CryptoRandomString(length)
-}
-
 // AesEncrypt encrypts text and given key with AES.
 func AesEncrypt(key, text []byte) ([]byte, error) {
 	block, err := aes.NewCipher(key)
diff --git a/modules/secret/secret_test.go b/modules/secret/secret_test.go
index f3a88eecc8..b1c99d8513 100644
--- a/modules/secret/secret_test.go
+++ b/modules/secret/secret_test.go
@@ -10,17 +10,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestNew(t *testing.T) {
-	result, err := New()
-	assert.NoError(t, err)
-	assert.True(t, len(result) == 44)
-
-	result2, err := New()
-	assert.NoError(t, err)
-	// check if secrets
-	assert.NotEqual(t, result, result2)
-}
-
 func TestEncryptDecrypt(t *testing.T) {
 	var hex string
 	var str string
-- 
cgit v1.2.3