summaryrefslogtreecommitdiff
path: root/src/server
diff options
context:
space:
mode:
authorMeiMei <30769358+mei23@users.noreply.github.com>2020-03-29 23:16:36 +0900
committerGitHub <noreply@github.com>2020-03-29 23:16:36 +0900
commit244ef0cb8f82b18c22990ece728f2e1fe8398a62 (patch)
tree781b5820207bf78d831f13928d5b5253582436b0 /src/server
parent12.28.0 (diff)
downloadsharkey-244ef0cb8f82b18c22990ece728f2e1fe8398a62.tar.gz
sharkey-244ef0cb8f82b18c22990ece728f2e1fe8398a62.tar.bz2
sharkey-244ef0cb8f82b18c22990ece728f2e1fe8398a62.zip
トークン系の乱数ソースではcryptoを使うように (#6200)
Diffstat (limited to 'src/server')
-rw-r--r--src/server/api/common/generate-native-user-token.ts4
-rw-r--r--src/server/api/endpoints/app/create.ts4
-rw-r--r--src/server/api/endpoints/auth/accept.ts4
-rw-r--r--src/server/api/endpoints/miauth/gen-token.ts4
4 files changed, 8 insertions, 8 deletions
diff --git a/src/server/api/common/generate-native-user-token.ts b/src/server/api/common/generate-native-user-token.ts
index a372221a0a..cd30ba98f9 100644
--- a/src/server/api/common/generate-native-user-token.ts
+++ b/src/server/api/common/generate-native-user-token.ts
@@ -1,3 +1,3 @@
-import rndstr from 'rndstr';
+import { secureRndstr } from '../../../misc/secure-rndstr';
-export default () => rndstr('a-zA-Z0-9', 16);
+export default () => secureRndstr(16, true);
diff --git a/src/server/api/endpoints/app/create.ts b/src/server/api/endpoints/app/create.ts
index ac3e8a18d2..776865ffb6 100644
--- a/src/server/api/endpoints/app/create.ts
+++ b/src/server/api/endpoints/app/create.ts
@@ -1,9 +1,9 @@
-import rndstr from 'rndstr';
import $ from 'cafy';
import define from '../../define';
import { Apps } from '../../../../models';
import { genId } from '../../../../misc/gen-id';
import { unique } from '../../../../prelude/array';
+import { secureRndstr } from '../../../../misc/secure-rndstr';
export const meta = {
tags: ['app'],
@@ -60,7 +60,7 @@ export const meta = {
export default define(meta, async (ps, user) => {
// Generate secret
- const secret = rndstr('a-zA-Z0-9', 32);
+ const secret = secureRndstr(32, true);
// for backward compatibility
const permission = unique(ps.permission.map(v => v.replace(/^(.+)(\/|-)(read|write)$/, '$3:$1')));
diff --git a/src/server/api/endpoints/auth/accept.ts b/src/server/api/endpoints/auth/accept.ts
index 8ba15ba815..e9281f1236 100644
--- a/src/server/api/endpoints/auth/accept.ts
+++ b/src/server/api/endpoints/auth/accept.ts
@@ -1,4 +1,3 @@
-import rndstr from 'rndstr';
import * as crypto from 'crypto';
import $ from 'cafy';
import define from '../../define';
@@ -6,6 +5,7 @@ import { ApiError } from '../../error';
import { AuthSessions, AccessTokens, Apps } from '../../../../models';
import { genId } from '../../../../misc/gen-id';
import { ensure } from '../../../../prelude/ensure';
+import { secureRndstr } from '../../../../misc/secure-rndstr';
export const meta = {
tags: ['auth'],
@@ -39,7 +39,7 @@ export default define(meta, async (ps, user) => {
}
// Generate access token
- const accessToken = rndstr('a-zA-Z0-9', 32);
+ const accessToken = secureRndstr(32, true);
// Fetch exist access token
const exist = await AccessTokens.findOne({
diff --git a/src/server/api/endpoints/miauth/gen-token.ts b/src/server/api/endpoints/miauth/gen-token.ts
index efa8680805..d8c74ec8d7 100644
--- a/src/server/api/endpoints/miauth/gen-token.ts
+++ b/src/server/api/endpoints/miauth/gen-token.ts
@@ -1,8 +1,8 @@
-import rndstr from 'rndstr';
import $ from 'cafy';
import define from '../../define';
import { AccessTokens } from '../../../../models';
import { genId } from '../../../../misc/gen-id';
+import { secureRndstr } from '../../../../misc/secure-rndstr';
export const meta = {
tags: ['auth'],
@@ -36,7 +36,7 @@ export const meta = {
export default define(meta, async (ps, user) => {
// Generate access token
- const accessToken = rndstr('a-zA-Z0-9', 32);
+ const accessToken = secureRndstr(32, true);
// Insert access token doc
await AccessTokens.save({