Skip to content

Fix #4657: Implement UUID.randomUUID() using java.security.SecureRandom.#4659

Merged
sjrd merged 2 commits intoscala-js:mainfrom
sjrd:securerandom-for-randomuuid
Apr 2, 2022
Merged

Fix #4657: Implement UUID.randomUUID() using java.security.SecureRandom.#4659
sjrd merged 2 commits intoscala-js:mainfrom
sjrd:securerandom-for-randomuuid

Conversation

@sjrd
Copy link
Copy Markdown
Member

@sjrd sjrd commented Mar 30, 2022

Since Scala.js core does not implement SecureRandom, this means that randomUUID() will fail to link unless SecureRandom is otherwise provided.

We move the tests for randomUUID() in the test-suite-ex, and we implement a fake SecureRandom in the javalib-ext-dummies for testing purposes.


Accompanying PRs in https://github.com/scala-js/scala-js-java-securerandom and https://github.com/scala-js/scala-js-fake-insecure-java-securerandom are coming.

@ekrich
Copy link
Copy Markdown
Contributor

ekrich commented Mar 30, 2022

Just curious if this import is needed?

@sjrd
Copy link
Copy Markdown
Member Author

sjrd commented Mar 30, 2022

It doesn't seem so, but it's also not related to this PR so I won't touch it now.

@ekrich
Copy link
Copy Markdown
Contributor

ekrich commented Mar 30, 2022

I can confirm that the Scala Native doesn't have an import and looks like it is code from Scala.js but it doesn't have an attribution.

@catap
Copy link
Copy Markdown
Contributor

catap commented Mar 30, 2022

@sjrd are you sure that quite degradation to java.util.Random is good idea?

I afraid that it may introduce an issue like this one: https://android-developers.googleblog.com/2013/08/some-securerandom-thoughts.html

@sjrd
Copy link
Copy Markdown
Member Author

sjrd commented Mar 31, 2022

Of course it's not a good idea! That's why it's only in the package called scalajs-fake-insecure-java-securerandom, whose readme makes every possible effort to tell people not to use it. It's only there if you have no other migration choice.

The other, recommended package does not silently degrade. It guarantees that it will throw if it can't use a proper source of cryptographically secure random numbers.

Copy link
Copy Markdown
Contributor

@gzm0 gzm0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only optional nits.

Comment thread javalib-ext-dummies/src/main/scala/java/security/SecureRandom.scala Outdated
Comment thread javalib/src/main/scala/java/util/UUID.scala
…cureRandom.

Since Scala.js core does not implement `SecureRandom`, this means
that `randomUUID()` will fail to link unless `SecureRandom` is
otherwise provided.

We move the tests for `randomUUID()` in the test-suite-ex, and we
implement a fake `SecureRandom` in the javalib-ext-dummies for
testing purposes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants