Weak randomness (ARCH6115)

Ce contenu n’est pas encore disponible dans votre langue.

Key ruby.security.weak-random · Severity warning · Category security · CWE CWE-338

Using a non-cryptographic PRNG like rand/Random for security values such as tokens, keys, salts, OTPs, or session ids makes the generated value predictable.

Incorrect

def token
  rand(10**10).to_s
end

Correct

def token
  SecureRandom.hex(16)
end

Fix

Use a cryptographically secure generator like SecureRandom for security-sensitive values.