Repository navigation
Random GUIDs and UUID, and Randomizer.java #737
Description
[Extracted from a post by @noloader to the ESAPI-Project-Users list on August 22, 2022.]
Describe the bug
It looks like Randomizer.java is providing random UUIDs. The reference
given is dead.[1] I went back to 2007 and the IETF returned 404's.
Nowadays I think you should use RFC 1422 and UUIDv4.[2] From Section
4.1.3 of [2]:
Msb0 Msb1 Msb2 Msb3 Version Description
...
0 1 0 0 4 The randomly or pseudo-
randomly generated version
specified in this document.
[1] http://www.ietf.org/internet-drafts/draft-mealling-uuid-urn-03.txt
[2] https://datatracker.ietf.org/doc/html/rfc4122
Specify what ESAPI version(s) you are experiencing this bug in
ESAPI 2.5.0.
Expected behavior
A random Version-4 type UUID, conformant with RFC 4122, should be produced when calling:
ESAPI.randomizer().getRandomGUID();
Activity
kwwall commentedon Aug 22, 2022
Unless anyone has some objection, I propose that ESAPI's
DefaultRandomizer.getRandomGUID()should just call the static method,where the
UUIDclass isjava.util.UUID.That returns a Type 4 UUID as defined in RFC4122. The implementation of the
java.util.UUIDclass usesjava.security.SecureRandomfor that. Our use of ESAPI predates implementation of thejava.uil.UUIDclass though, as it wasn't added until Java 5.jeremiahjstacey commentedon Aug 22, 2022
If this method was created to fill a void of the java runtime that has since been provided, then I think it's worth considering deprecating
DefaultRandomizer.getRandomGUID()in favor of the java-supplied UUID method?kwwall commentedon Aug 22, 2022