Skip to content

Commit bc24f81

Browse files
🔒 [security] Replace insecure random with secrets for hardware ID
The hardware ID generation was using the insecure `random` module, which is not suitable for generating secure identifiers. This commit replaces it with the cryptographically secure `secrets` module while maintaining the exact output format (prefix "V" + 32 uppercase hexadecimal characters). 🎯 **What:** The vulnerability fixed is the use of insecure randomness (via `random.randbytes`) for generating hardware IDs. ⚠️ **Risk:** Hardware IDs generated with `random` might be predictable, potentially allowing an attacker to guess or collision identifiers if the random seed is compromised or predictable. 🛡️ **Solution:** Switched to `secrets.token_hex(16).upper()`, which uses the system's best available source of randomness and is recommended for security-sensitive contexts. Co-authored-by: rnovatorov <20299819+rnovatorov@users.noreply.github.com>
1 parent c311b04 commit bc24f81

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

src/enapter/http/api/devices/client.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import random
1+
import secrets
22
import time
33
from typing import AsyncGenerator
44

@@ -161,4 +161,4 @@ def random_device_name(device_type: DeviceType) -> str:
161161

162162

163163
def random_hardware_id() -> str:
164-
return "V" + "".join(f"{b:02X}" for b in random.randbytes(16))
164+
return "V" + secrets.token_hex(16).upper()

0 commit comments

Comments
 (0)