aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorskjnldsv <skjnldsv@protonmail.com>2025-06-21 10:08:08 +0200
committerskjnldsv <skjnldsv@protonmail.com>2025-06-21 10:09:21 +0200
commit04c9868e00f94aee0583f9aee7f4573b905f2e16 (patch)
tree0d84ef8d708ab7573460c8e51a3086dda443e71c
parentec73f4a9254b2013f7d224b40d1ec009c25593b1 (diff)
downloadnextcloud-server-fix/insecure-crypto-env.tar.gz
nextcloud-server-fix/insecure-crypto-env.zip
fix(files_sharing): fallback self.crypto.getRandomValuesfix/insecure-crypto-env
Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
-rw-r--r--apps/files_sharing/src/utils/GeneratePassword.ts21
1 files changed, 20 insertions, 1 deletions
diff --git a/apps/files_sharing/src/utils/GeneratePassword.ts b/apps/files_sharing/src/utils/GeneratePassword.ts
index 2f3f65c51d8..82efaaa69d4 100644
--- a/apps/files_sharing/src/utils/GeneratePassword.ts
+++ b/apps/files_sharing/src/utils/GeneratePassword.ts
@@ -38,10 +38,29 @@ export default async function(verbose = false): Promise<string> {
const array = new Uint8Array(10)
const ratio = passwordSet.length / 255
- self.crypto.getRandomValues(array)
+ getRandomValues(array)
let password = ''
for (let i = 0; i < array.length; i++) {
password += passwordSet.charAt(array[i] * ratio)
}
return password
}
+
+/**
+ * Fills the given array with cryptographically secure random values.
+ * If the crypto API is not available, it falls back to less secure Math.random().
+ * Crypto API is available in modern browsers on secure contexts (HTTPS).
+ *
+ * @param {Uint8Array} array - The array to fill with random values.
+ */
+function getRandomValues(array: Uint8Array): void {
+ if (self?.crypto?.getRandomValues) {
+ self.crypto.getRandomValues(array)
+ return
+ }
+
+ let len = array.length
+ while (len--) {
+ array[len] = Math.floor(Math.random() * 256)
+ }
+}