FakerPHP / Faker

Faker is a PHP library that generates fake data for you
https://fakerphp.github.io
Other
3.57k stars 345 forks source link

The output of Base::randomFloat() is biased for certain inputs #760

Open TimWolla opened 1 year ago

TimWolla commented 1 year ago

Summary

As per the Drawing Random Floating-Point Numbers from an Interval. Frédéric Goualard, ACM Trans. Model. Comput. Simul., 32:3, 2022. https://doi.org/10.1145/3503512 paper, the $min + rand() / randmax() * ($max - $min) construction of Base::randomFloat()

https://github.com/FakerPHP/Faker/blob/2.0/src/Faker/Provider/Base.php#L111-L132

is unsafe and depending on the inputs might:

  1. Return values outside of the requested range.
  2. Return values that are biased towards specific subintervals.

This is unfixable in userland. The only solution is to leverage PHP 8.3's Randomizer::getFloat() which will do the right thing. See the https://wiki.php.net/rfc/randomizer_additions RFC for additional details.