Potential fix for code scanning alert no. 23: Insecure randomness

[EthanThePhoenix38]

Potential fix for https://github.com/ThePhoenixAgency/AI-Pulse/security/code-scanning/23

In general, the fix is to stop using Math.random() for generating the UUID/session ID and instead use a cryptographically secure source of randomness. In browsers, the standard is crypto.getRandomValues; in modern environments there’s also crypto.randomUUID(), but we should not assume it is always present. We can implement a secure UUIDv4 generator that uses crypto.getRandomValues when available and only fall back to Math.random() if no secure source exists, keeping comments and behavior as close as possible.

Concretely, in js/tracker.js:

1. Add a small helper method on Tracker, e.g. getSecureRandomValues, that wraps crypto.getRandomValues when available (browser or Node globalThis.crypto) and otherwise falls back to filling a typed array with Math.random() as a last resort. This preserves functionality in very old/non-standard environments while using CSPRNG where possible.
2. Rewrite generateUUID to:
   • Obtain 16 random bytes using this.getSecureRandomValues(new Uint8Array(16)).
   • Set the UUID version and variant bits according to RFC 4122 (version 4, variant 1).
   • Convert the bytes into the canonical UUID string xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx.
3. Ensure all this is done within the existing snippet and object; no external dependencies are needed and we don’t modify other logic like ensureSession.

The main change is around lines 86–118, plus inserting the helper method just before generateUUID. No new imports are needed because crypto is accessed via globalThis/window where available.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

---

Continue Tasks: ▶️ 1 queued — View all

[Copilot]

Pull request overview

This pull request addresses a security vulnerability (code scanning alert #23) by replacing the use of insecure Math.random() with cryptographically secure crypto.getRandomValues() for UUID generation in the tracker module. The change ensures that session IDs and visitor IDs are generated using a cryptographically secure pseudo-random number generator (CSPRNG) when available, significantly improving the security of these identifiers.

Changes:

• Added getSecureRandomValues() helper method that uses crypto.getRandomValues() when available and falls back to Math.random() for compatibility
• Rewrote generateUUID() to generate UUIDs using RFC 4122-compliant byte manipulation with secure random values
• Maintained backward compatibility while significantly improving security posture

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.