🔒 [Security Fix] Use cryptographically secure randomness for savepoint names - #449
Conversation
Replaces Math.random() with crypto.randomUUID() via cryptoShim to ensure unique and secure savepoint name generation. Refactors inline savepoint logic to reuse createSavepointName.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
The first draft only listed this session's PRs (#457+). main had ~20 more unreleased PRs merged after the v1.5.2 tag (#428–#456) that were never changelogged — fixes (#456 rowid validation, #453 data masking), a security fix (#449 crypto savepoint names), perf (#443, #439, #440), refactors, tests, and dep bumps. Entry now reflects the full v1.5.2..HEAD range. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: release 1.5.3 Maintenance release covering everything merged since 1.5.2: internal code-health, expanded unit-test coverage, and dev-dependency bumps. No user-facing behavior change; error logging now routes to the SQLite Explorer output channel. package.json version + CHANGELOG only — package-lock.json left at 1.5.2 per the project's lockfile-drift convention. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(changelog): expand 1.5.3 to cover all PRs since v1.5.2 The first draft only listed this session's PRs (#457+). main had ~20 more unreleased PRs merged after the v1.5.2 tag (#428–#456) that were never changelogged — fixes (#456 rowid validation, #453 data masking), a security fix (#449 crypto savepoint names), perf (#443, #439, #440), refactors, tests, and dep bumps. Entry now reflects the full v1.5.2..HEAD range. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 participant
Math.random()to generate savepoint names inWasmDatabaseEngine.Math.random()generates predictable values, allowing an attacker to guess savepoint names, potentially leading to unauthorized data manipulation or race conditions when savepoints are released or rolled back prematurely in nested transactions.Math.random()withcrypto.randomUUID()fromcryptoShimand ensuring consistent savepoint name generation via thecreateSavepointNamemethod.PR created automatically by Jules for task 17206054167106175443 started by @zknpr