Merge pull request #2130 from reasonerjt/use-crypto-rand

replace math/rand with crypto/rand

src/common/utils/utils.go

@@ -15,8 +15,8 @@
 package utils
 
 import (
+	"crypto/rand"
 	"fmt"
-	"math/rand"
 	"net"
 	"net/url"
 	"strings"
@@ -65,11 +65,15 @@ func ParseRepository(repository string) (project, rest string) {
 // GenerateRandomString generates a random string
 func GenerateRandomString() string {
 	length := 32
-	rand.Seed(time.Now().UTC().UnixNano())
 	const chars = "abcdefghijklmnopqrstuvwxyz0123456789"
+	l := len(chars)
 	result := make([]byte, length)
+	_, err := rand.Read(result)
+	if err != nil {
+		log.Warningf("Error reading random bytes: %v", err)
+	}
 	for i := 0; i < length; i++ {
-		result[i] = chars[rand.Intn(len(chars))]
+		result[i] = chars[int(result[i])%l]
 	}
 	return string(result)
 }

src/common/utils/utils_test.go

@@ -140,6 +140,10 @@ func TestGenerateRandomString(t *testing.T) {
 	if len(str) != 32 {
 		t.Errorf("unexpected length: %d != %d", len(str), 32)
 	}
+	str2 := GenerateRandomString()
+	if str2 == str {
+		t.Errorf("Two identical random strings in a row: %s", str)
+	}
 }
 
 func TestParseLink(t *testing.T) {