Potential fix for https://github.com/ThePhoenixAgency/AI-Pulse/security/code-scanning/23

In general, the fix is to stop using Math.random() for generating the UUID/session ID and instead use a cryptographically secure source of randomness. In browsers, the standard is crypto.getRandomValues; in modern environments there’s also crypto.randomUUID(), but we should not assume it is always present. We can implement a secure UUIDv4 generator that uses crypto.getRandomValues when available and only fall back to Math.random() if no secure source exists, keeping comments and behavior as close as possible.

Concretely, in js/tracker.js:

1. Add a small helper method on Tracker, e.g. getSecureRandomValues, that wraps crypto.getRandomValues when available (browser or Node globalThis.crypto) and otherwise falls back to filling a typed array with Math.random() as a last resort. This preserves functionality in very old/non-standard environments while using CSPRNG where possible.
2. Rewrite generateUUID to:
   • Obtain 16 random bytes using this.getSecureRandomValues(new Uint8Array(16)).
   • Set the UUID version and variant bits according to RFC 4122 (version 4, variant 1).
   • Convert the bytes into the canonical UUID string xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx.
3. Ensure all this is done within the existing snippet and object; no external dependencies are needed and we don’t modify other logic like ensureSession.

The main change is around lines 86–118, plus inserting the helper method just before generateUUID. No new imports are needed because crypto is accessed via globalThis/window where available.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Continue Tasks: ▶️ 1 queued — View all