Philipp Hörist pushed to branch master at gajim / python-nbxmpp
Commits:
2cb29bd8 by Philipp Hörist at 2026-08-12T00:05:49+02:00
imprv: Use secrets module instead of random
The secrets module provides better randomness for cryptographic purposes
- - - - -
3 changed files:
- nbxmpp/modules/openpgp.py
- nbxmpp/structs.py
- pyproject.toml
Changes:
=====================================
nbxmpp/modules/openpgp.py
=====================================
@@ -9,7 +9,7 @@ from __future__ import annotations
from typing import Any
from typing import TYPE_CHECKING
-import random
+import secrets
import string
import time
@@ -344,8 +344,8 @@ def create_signcrypt_node(
def get_rpad() -> str:
- rpad_range = random.randint(30, 50)
- return "".join(random.choice(string.ascii_letters) for _ in
range(rpad_range))
+ rpad_range = secrets.randbelow(21) + 30
+ return "".join(secrets.choice(string.ascii_letters) for _ in
range(rpad_range))
def create_message_stanza(
=====================================
nbxmpp/structs.py
=====================================
@@ -12,7 +12,7 @@ from typing import NamedTuple
from typing import TYPE_CHECKING
import logging
-import random
+import secrets
import time
from collections.abc import Sequence
from dataclasses import dataclass
@@ -826,7 +826,7 @@ class OMEMOBundle(NamedTuple):
namespace: str = Namespace.OMEMO_TEMP
def pick_prekey(self) -> dict[str, str]:
- return random.SystemRandom().choice(self.otpks)
+ return secrets.choice(self.otpks)
class ChatMarker(NamedTuple):
=====================================
pyproject.toml
=====================================
@@ -219,7 +219,6 @@ ignore = [
"S112", # try`-`except`-`continue`
"S303", # Use of insecure MD2, MD4, MD5, or SHA1 hash function
"S310", # Audit URL open for permitted schemes
- "S311", # Standard pseudo-random generators are not suitable for
cryptographic purposes
"S314", # Using `xml` to parse untrusted data is known to be vulnerable to
XML attacks; use `defusedxml` equivalents
"S324", # Probable use of insecure hash functions
"S608", # Possible SQL injection vector through string-based query
construction
View it on GitLab:
https://dev.gajim.org/gajim/python-nbxmpp/-/commit/2cb29bd84a84f0ece80f3728be2f9cfdb9ece577
--
View it on GitLab:
https://dev.gajim.org/gajim/python-nbxmpp/-/commit/2cb29bd84a84f0ece80f3728be2f9cfdb9ece577
You're receiving this email because of your account on dev.gajim.org.
_______________________________________________
Commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
