mirror of
https://github.com/suitenumerique/meet.git
synced 2026-08-19 23:07:29 +00:00
tuanaiseo
fc260b2686
Room identifiers are created with `Math.random()`, which is predictable and not suitable for security-sensitive identifiers. Predictable room IDs increase the risk of room enumeration and unauthorized access attempts, especially when IDs are part of join URLs. Affected files: generateRoomId.ts Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>
25 lines
785 B
TypeScript
25 lines
785 B
TypeScript
// Google Meet uses only letters in a room identifier
|
|
const ROOM_ID_ALLOWED_CHARACTERS = 'abcdefghijklmnopqrstuvwxyz'
|
|
|
|
const getRandomChar = () => {
|
|
const maxValue =
|
|
Math.floor(0x100000000 / ROOM_ID_ALLOWED_CHARACTERS.length) *
|
|
ROOM_ID_ALLOWED_CHARACTERS.length
|
|
const randomValue = new Uint32Array(1)
|
|
|
|
do {
|
|
crypto.getRandomValues(randomValue)
|
|
} while (randomValue[0] >= maxValue)
|
|
|
|
return ROOM_ID_ALLOWED_CHARACTERS[
|
|
randomValue[0] % ROOM_ID_ALLOWED_CHARACTERS.length
|
|
]
|
|
}
|
|
|
|
const generateSegment = (length: number): string =>
|
|
Array.from(Array(length), getRandomChar).join('')
|
|
|
|
// Generates a unique room identifier following the Google Meet format
|
|
export const generateRoomId = () =>
|
|
[generateSegment(3), generateSegment(4), generateSegment(3)].join('-')
|