storytold/effectcraft
1
0 Fork 0
mirror of https://github.com/storytold/effectcraft.git synced 2026-10-22 18:22:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: use crypto.randomUUID for temp file suffix (SonarCloud S2245)

Browse Source 
Replace Math.random() with crypto.randomUUID() when generating the unique
suffix for the atomic write-then-move temp file. The value isn't security-
sensitive, but a CSPRNG gives a stronger uniqueness guarantee and resolves
SonarCloud javascript:S2245.
This commit is contained in:
Dylan M. Taylor committed 2026-10-21 17:14:27 -04:00
1 parent cee4c16c8a
commit 887fe3a3a8
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
apps/effectcraft-web/js/host.js
+1 -1
View File
@@ -495,7 +495,7 @@ export async function cacheRead(name) {
export async function cacheWrite(fullName, bytes) { export async function cacheWrite(fullName, bytes) {
const [dir, name] = await entryDir(fullName); const [dir, name] = await entryDir(fullName);
const canMove = typeof FileSystemHandle !== "undefined" && "move" in FileSystemHandle.prototype; const canMove = typeof FileSystemHandle !== "undefined" && "move" in FileSystemHandle.prototype;
const tmp = canMove ? `${name}.tmp.${Math.random().toString(36).slice(2)}` : name; const tmp = canMove ? `${name}.tmp.${crypto.randomUUID()}` : name;
const fh = await dir.getFileHandle(tmp, { create: true }); const fh = await dir.getFileHandle(tmp, { create: true });
if (fh.createSyncAccessHandle) { if (fh.createSyncAccessHandle) {
const h = await fh.createSyncAccessHandle(); const h = await fh.createSyncAccessHandle();