diff --git a/src/PSProxmoxVE.Core/Client/PveHttpClient.cs b/src/PSProxmoxVE.Core/Client/PveHttpClient.cs index 36df156..76d4512 100644 --- a/src/PSProxmoxVE.Core/Client/PveHttpClient.cs +++ b/src/PSProxmoxVE.Core/Client/PveHttpClient.cs @@ -4,6 +4,7 @@ using System.IO; using System.Net; using System.Net.Http; using System.Net.Http.Headers; +using System.Security.Cryptography; using System.Text; using System.Threading.Tasks; using Newtonsoft.Json.Linq; @@ -387,14 +388,20 @@ namespace PSProxmoxVE.Core.Client return body.Length > 512 ? body.Substring(0, 512) + "..." : body; } - /// Generates a random 32-character alphanumeric boundary string. + /// Generates a random 32-character alphanumeric boundary string using a cryptographic RNG. private static string GenerateBoundary() { const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; - var rng = new Random(); + var bytes = new byte[32]; +#if NET48 || NETSTANDARD2_0 + using (var rng = RandomNumberGenerator.Create()) + rng.GetBytes(bytes); +#else + RandomNumberGenerator.Fill(bytes); +#endif var sb = new StringBuilder(32); for (int i = 0; i < 32; i++) - sb.Append(chars[rng.Next(chars.Length)]); + sb.Append(chars[bytes[i] % chars.Length]); return sb.ToString(); }