hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 07:15:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Docs review suggestions

Browse Source 
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
This commit is contained in:
Edward Minnix III
2023-12-08 10:37:29 -05:00
committed by Ed Minnix
parent 7362158229
commit ce20c4ae03
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/src/Security/CWE/CWE-330/InsecureRandomness.qhelp
View File

@@ -4,13 +4,13 @@
<qhelp>
<overview>
<p>
Using a cryptographically weak pseudo-random number generator to generate a security-sensitive value,
such as a password, makes it easier for an attacker to predict the value.
If you use a cryptographically weak pseudo-random number generator to generate security-sensitive values,
such as passwords, attackers can more easily predict those values.
</p>
<p>
Pseudo-random number generators generate a sequence of numbers that only approximates the properties
of random numbers. The sequence is not truly random because it is completely determined by a
relatively small set of initial values, the seed. If the random number generator is
relatively small set of initial values (the seed). If the random number generator is
cryptographically weak, then this sequence may be easily predictable through outside observations.
</p>
@@ -18,7 +18,7 @@
<recommendation>
<p>
Use a cryptographically secure pseudo-random number generator if the output is to be used in a
security-sensitive context. As a rule of thumb, a value should be considered "security-sensitive"
security-sensitive context. As a general rule, a value should be considered "security-sensitive"
if predicting it would allow the attacker to perform an action that they would otherwise be unable
to perform. For example, if an attacker could predict the random password generated for a new user,
they would be able to log in as that new user.
@@ -36,7 +36,7 @@
</p>
<p>
In the first case, we generate a fresh cookie by appending a random integer to the end of a static
In the first (BAD) case, we generate a fresh cookie by appending a random integer to the end of a static
string. The random number generator used (<code>Random</code>) is not cryptographically secure,
so it may be possible for an attacker to predict the generated cookie.
</p>