Skip to content

Commit 1ece32a

Browse files
Zie619claude
andcommitted
fix(security): [SEC-24] add error check on crypto/rand.Read in Go SDK
Check rand.Read return value and panic on failure to prevent use of uninitialized event IDs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent c6a60bd commit 1ece32a

1 file changed

Lines changed: 5 additions & 1 deletion

File tree

trusera-sdk-go/events.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,11 @@ type Event struct {
3131
// generateID creates a random hex ID
3232
func generateID() string {
3333
b := make([]byte, 16)
34-
rand.Read(b)
34+
// rand.Read from crypto/rand always returns len(b) and nil error on Go 1.21+,
35+
// but we check for correctness on older versions.
36+
if _, err := rand.Read(b); err != nil {
37+
panic("crypto/rand failed: " + err.Error())
38+
}
3539
return hex.EncodeToString(b)
3640
}
3741

0 commit comments

Comments
 (0)