search

zloirock / core-js

Standard Library
MIT License
24.6k stars 1.66k forks source link

Math.random() usage #1315

Closed swetha8612 closed 11 months ago

swetha8612 commented 11 months ago

As part of our company's security policy, we run all our application through fortify scan. Fortify scan raised a flag in a couple of places where Math.random() has been used. It is suggesting to replace with window.crypto.getRandomValues(new Uint32Array(10))[0]. Could you please have a look. Thank you.

zloirock commented 11 months ago

It's used in one place as a part of uniq key generation. It can't be replaced with window.crypto.getRandomValues(new Uint32Array(10))[0] since in almost all cases it's usage in ancient engines where crypto.getRandomValues and even Uint32Array are not available.