diff options
author | skjnldsv <skjnldsv@protonmail.com> | 2025-06-21 10:08:08 +0200 |
---|---|---|
committer | skjnldsv <skjnldsv@protonmail.com> | 2025-06-21 10:09:21 +0200 |
commit | 04c9868e00f94aee0583f9aee7f4573b905f2e16 (patch) | |
tree | 0d84ef8d708ab7573460c8e51a3086dda443e71c | |
parent | ec73f4a9254b2013f7d224b40d1ec009c25593b1 (diff) | |
download | nextcloud-server-fix/insecure-crypto-env.tar.gz nextcloud-server-fix/insecure-crypto-env.zip |
fix(files_sharing): fallback self.crypto.getRandomValuesfix/insecure-crypto-env
Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
-rw-r--r-- | apps/files_sharing/src/utils/GeneratePassword.ts | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/apps/files_sharing/src/utils/GeneratePassword.ts b/apps/files_sharing/src/utils/GeneratePassword.ts index 2f3f65c51d8..82efaaa69d4 100644 --- a/apps/files_sharing/src/utils/GeneratePassword.ts +++ b/apps/files_sharing/src/utils/GeneratePassword.ts @@ -38,10 +38,29 @@ export default async function(verbose = false): Promise<string> { const array = new Uint8Array(10) const ratio = passwordSet.length / 255 - self.crypto.getRandomValues(array) + getRandomValues(array) let password = '' for (let i = 0; i < array.length; i++) { password += passwordSet.charAt(array[i] * ratio) } return password } + +/** + * Fills the given array with cryptographically secure random values. + * If the crypto API is not available, it falls back to less secure Math.random(). + * Crypto API is available in modern browsers on secure contexts (HTTPS). + * + * @param {Uint8Array} array - The array to fill with random values. + */ +function getRandomValues(array: Uint8Array): void { + if (self?.crypto?.getRandomValues) { + self.crypto.getRandomValues(array) + return + } + + let len = array.length + while (len--) { + array[len] = Math.floor(Math.random() * 256) + } +} |