This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/attachment-boundaries in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 5c5911a4fbc0bb060071e41aae09a1a700c67c32 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Jul 29 15:27:17 2025 +0100 Switch to SecureRandom for AttachmentUtil --- core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java index a8859cb7f0..b6cfc56591 100644 --- a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java +++ b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java @@ -29,6 +29,7 @@ import java.net.URL; import java.net.URLDecoder; import java.net.URLEncoder; import java.nio.charset.StandardCharsets; +import java.security.SecureRandom; import java.util.AbstractMap; import java.util.AbstractSet; import java.util.ArrayList; @@ -40,7 +41,6 @@ import java.util.Iterator; import java.util.LinkedHashMap; import java.util.List; import java.util.Map; -import java.util.Random; import java.util.Set; import java.util.UUID; import java.util.concurrent.atomic.AtomicInteger; @@ -81,7 +81,7 @@ public final class AttachmentUtil { private static final AtomicInteger COUNTER = new AtomicInteger(); private static final String ATT_UUID = UUID.randomUUID().toString(); - private static final Random BOUND_RANDOM = new Random(); + private static final SecureRandom BOUND_RANDOM = new SecureRandom(); private static final CommandMap DEFAULT_COMMAND_MAP = CommandMap.getDefaultCommandMap(); private static final MailcapCommandMap COMMAND_MAP = new EnhancedMailcapCommandMap(); @@ -257,9 +257,6 @@ public final class AttachmentUtil { public static String getUniqueBoundaryValue() { //generate a random UUID. - //we don't need the cryptographically secure random uuid that - //UUID.randomUUID() will produce. Thus, use a faster - //pseudo-random thing long leastSigBits; long mostSigBits; synchronized (BOUND_RANDOM) {
