814659 - [Homescreen] Vulnerability analysis issues - DoATAPI.js

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Everything.me, defect)

Description

[Carmen Jimenez Cabezas]

We have run an automated vulnerability analysis on the Gaia code. 
After manually filtering the results we have found the following possible issue on the Homescreen app:

* everything.me/js/api/DoATAPI.js

On lines 877 and 594 of DoATAPI.js the program uses insecure Randomness. Standard pseudo-random number generators cannot withstand cryptographic attacks.

875 var queryString = {};
876 (location.search || '').replace(/(?:[?&]|^)([^=]+)=([^&]*)/g, function(ig, k, v) {queryString[k] = v;})
877 return queryString["did"] || "web_" + (new Date()).getTime() + "" + Math.round(Math.random()*1234567890);
878 }

592
593 this.generateId = function() {
594 return SESSION_PREFIX + Math.round(Math.random()*1234567890);
595 };
596

The standard pseudorandom generator isn't good enough for anything that requires non predictability.
If this session is used to keeping track of a session at the server, a more robust generator should be used.
http://baagoe.org/en/w/index.php/Better_random_numbers_for_javascript
homescreen's everything.me/js/api/DoATAPI.js can be checked for a better way to implement this.

Comment 1

[Carmen Jimenez Cabezas]

>> homescreen's everything.me/js/api/DoATAPI.js can be checked for a better way to >> implement this.

Sorry for the error. This should read "Calendar's js/ext/uuid.js can be checked for a better way to securely implement random number generation"

Comment 2

[Joey Simhon]

We'll implement the uuid.js to replace Math.random()

Comment 3

[Evyatar 'Tron' Amitay (everything.me)]

Attachment: Patch - redirect to github PR

Comment 4

[Cristian Rodriguez (:crdlc)]

Comment on attachment 707034 [details]
Patch - redirect to github PR

ok from my side

Comment 5

[Francisco Jordano [:arcturus] [:francisco]]

Nominating as tracking-b2g18 cause it could represent a security issue.

The bug is reviewed, IMHO, we should accept it for v1-train.

Thanks,
F.

Comment 6

[Lukas Blakk [:lsblakk] use ?needinfo]

Comment on attachment 707034 [details]
Patch - redirect to github PR

approving for v1-train.

Comment 7

[John Ford [:jhford] CET/CEST Berlin Time]

382badc6261f37155b9876eb56aa6f97b4b73f83

Comment 8

[John Ford [:jhford] CET/CEST Berlin Time]

(In reply to John Ford [:jhford] from comment #7)
> 382badc6261f37155b9876eb56aa6f97b4b73f83

v1-train: 382badc6261f37155b9876eb56aa6f97b4b73f83

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

Batch edit: bugs fixed on b2g18 since 1/25 branch of v1.0 are fixed on v1.0.1