[Fix] Switch to using crypto random for boundary values

benweissmann · ljharb · commit b88316c94bb0 · 2025-02-21T21:20:43.000-05:00
diff --git a/lib/form_data.js b/lib/form_data.js
@@ -7,6 +7,7 @@ var http = require('http');
 var https = require('https');
 var parseUrl = require('url').parse;
 var fs = require('fs');
+var crypto = require('crypto');
 var mime = require('mime-types');
 var asynckit = require('asynckit');
 var hasOwn = require('hasown');
@@ -357,16 +358,10 @@ FormData.prototype.getBuffer = function () {
 };
 
 FormData.prototype._generateBoundary = function () {
-  /*
-   * This generates a 50 character boundary similar to those used by Firefox.
-   * They are optimized for boyer-moore parsing.
-   */
-  var boundary = '--------------------------';
-  for (var i = 0; i < 24; i++) {
-    boundary += Math.floor(Math.random() * 10).toString(16);
-  }
+  // This generates a 50 character boundary similar to those used by Firefox.
 
-  this._boundary = boundary;
+  // They are optimized for boyer-moore parsing.
+  this._boundary = '--------------------------' + crypto.randomBytes(12).toString('hex');
 };
 
 /*
diff --git a/package.json b/package.json
@@ -62,6 +62,9 @@
     "obake": "^0.1.2",
     "phantomjs-prebuilt": "^2.1.16",
     "pkgfiles": "^2.3.2",
+    "pre-commit": "^1.2.2",
+    "predict-v8-randomness": "^1.0.35",
+    "puppeteer": "^1.20.0",
     "request": "~2.87.0",
     "rimraf": "^2.7.1",
     "tape": "^5.9.0"
diff --git a/test/integration/test-boundary-prediction.js b/test/integration/test-boundary-prediction.js
@@ -0,0 +1,52 @@
+'use strict';
+
+var common = require('../common');
+var assert = common.assert;
+var FormData = require(common.dir.lib + '/form_data');
+var predictV8Randomness = require('predict-v8-randomness');
+
+var initialSequence = [
+  Math.random(),
+  Math.random(),
+  Math.random(),
+  Math.random(),
+];
+var predictor = new predictV8Randomness.Predictor(initialSequence);
+
+predictor.predictNext(24).then(function (next24RandomOutputs) {
+  var predictedBoundary = next24RandomOutputs
+    .map(function (v) {
+      return Math.floor(v * 10).toString(16);
+    })
+    .join('');
+
+  var boundaryIntro = '----------------------------';
+
+  var payload = 'zzz\r\n' + boundaryIntro + predictedBoundary + '\r\nContent-Disposition: form-data; name="is_admin"\r\n\r\ntrue\r\n' + boundaryIntro + predictedBoundary + '--\r\n';
+
+  var FIELDS = {
+    my_field: {
+      value: payload,
+    },
+  };
+
+  // count total
+  var fieldsPassed = Object.keys(FIELDS).length;
+
+  // prepare form-receiving http server
+  var server = common.testFields(FIELDS, function (fields) {
+    fieldsPassed = fields;
+  });
+
+  server.listen(common.port, function () {
+    var form = new FormData();
+
+    common.actions.populateFields(form, FIELDS);
+
+    common.actions.submit(form, server);
+  });
+
+  process.on('exit', function () {
+    assert.strictEqual(fieldsPassed, 0);
+  });
+});
