From 01361884eb86a98eae9a61797113620710fcbffc Mon Sep 17 00:00:00 2001 From: Owen Schwartz Date: Thu, 4 Jun 2026 10:33:15 -0700 Subject: [PATCH] Potential fix for pull request finding 'CodeQL / Insecure randomness' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- server/private/routers/ssh/signSshKey.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/private/routers/ssh/signSshKey.ts b/server/private/routers/ssh/signSshKey.ts index f10cd407d..dac4ae62a 100644 --- a/server/private/routers/ssh/signSshKey.ts +++ b/server/private/routers/ssh/signSshKey.ts @@ -12,6 +12,7 @@ */ import { Request, Response, NextFunction } from "express"; +import { randomInt } from "crypto"; import { z } from "zod"; import { actionAuditLog, @@ -392,7 +393,7 @@ export async function signSshKey( if (existingUserWithSameName) { let foundUniqueUsername = false; for (let attempt = 0; attempt < 20; attempt++) { - const randomNum = Math.floor(Math.random() * 101); // 0 to 100 + const randomNum = randomInt(0, 101); // 0 to 100 const candidateUsername = `${usernameToUse}${randomNum}`; const [existingUser] = await db