search

c3js / c3

:bar_chart: A D3-based reusable chart library
http://c3js.org
MIT License
9.33k stars 1.39k forks source link

Insecure Randomness for the useof Math.random() in redrawBarForSubchart, redrawLineForSubchart and redrawAreaForSubchart(security vulnerability) #2874

Open shubhamvinayak opened 1 year ago

shubhamvinayak commented 1 year ago

Since Math.random could potentially return the same value twice and it is not cryptographically secure causing the insecure randomness when we scan the code in the fortify tool.

Please confirm if there is any future plan to remove Math.random and use cryptographically secure code for getting random values. just by using crypto API

const myArray = new Uint32Array(10);
crypto.getRandomValues(myArray);
  1. redrawBarForSubchart: https://github.com/c3js/c3/blob/master/c3.esm.js#L12493
  2. redrawLineForSubchart: https://github.com/c3js/c3/blob/master/c3.esm.js#L12526
  3. redrawAreaForSubchart: https://github.com/c3js/c3/blob/master/c3.esm.js#L12562
kondalraodurgam commented 1 year ago

Facing same issue +1

netil commented 1 year ago

For those who are interested on, it has been applied to billboard.js