From fb4a21a4f98f8671a13088d8d2c9e747db2be5f5 Mon Sep 17 00:00:00 2001 From: Clint Branham Date: Fri, 20 Mar 2026 12:31:40 -0500 Subject: [PATCH] fix: use cryptographic RNG for multipart boundary generation Replace `new Random()` with `RandomNumberGenerator` in PveHttpClient.GenerateBoundary(). Uses the static Fill() method on .NET Core and the disposable Create() pattern on net48/netstandard2.0. Co-Authored-By: Claude Opus 4.6 (1M context) --- src/PSProxmoxVE.Core/Client/PveHttpClient.cs | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/PSProxmoxVE.Core/Client/PveHttpClient.cs b/src/PSProxmoxVE.Core/Client/PveHttpClient.cs index 36df156..76d4512 100644 --- a/src/PSProxmoxVE.Core/Client/PveHttpClient.cs +++ b/src/PSProxmoxVE.Core/Client/PveHttpClient.cs @@ -4,6 +4,7 @@ using System.IO; using System.Net; using System.Net.Http; using System.Net.Http.Headers; +using System.Security.Cryptography; using System.Text; using System.Threading.Tasks; using Newtonsoft.Json.Linq; @@ -387,14 +388,20 @@ namespace PSProxmoxVE.Core.Client return body.Length > 512 ? body.Substring(0, 512) + "..." : body; } - /// Generates a random 32-character alphanumeric boundary string. + /// Generates a random 32-character alphanumeric boundary string using a cryptographic RNG. private static string GenerateBoundary() { const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; - var rng = new Random(); + var bytes = new byte[32]; +#if NET48 || NETSTANDARD2_0 + using (var rng = RandomNumberGenerator.Create()) + rng.GetBytes(bytes); +#else + RandomNumberGenerator.Fill(bytes); +#endif var sb = new StringBuilder(32); for (int i = 0; i < 32; i++) - sb.Append(chars[rng.Next(chars.Length)]); + sb.Append(chars[bytes[i] % chars.Length]); return sb.ToString(); }