fixing CWE-338 Use of Cryptographically Secure Pseudo-Random Number

Author: aswanidutt

dependency/vault_common.go

@@ -4,10 +4,12 @@
 package dependency
 
 import (
+	cryptorand "crypto/rand"
 	"encoding/json"
 	"fmt"
 	"log"
-	"math/rand"
+	"math/big"
+	mathrand "math/rand"
 	"sync"
 	"time"
 
@@ -185,15 +187,15 @@ func leaseCheckWait(s *Secret, retryCount int) time.Duration {
 		sleep = sleep / 3.0
 
 		// Use some randomness so many clients do not hit Vault simultaneously.
-		sleep = sleep * (rand.Float64() + 1) / 2.0
+		sleep = sleep * (mathrand.Float64() + 1) / 2.0
 	} else if !rotatingSecret {
 		// If the secret doesn't have a rotation period, this is a non-renewable leased
 		// secret.
 		// For non-renewable leases set the renew duration to use much of the secret
 		// lease as possible. Use a stagger over the configured threshold
 		// fraction of the lease duration so that many clients do not hit
 		// Vault simultaneously.
-		finalFraction := VaultLeaseRenewalThreshold + (rand.Float64()-0.5)*0.1
+		finalFraction := VaultLeaseRenewalThreshold + (mathrand.Float64()-0.5)*0.1
 		if finalFraction >= 1.0 || finalFraction <= 0.0 {
 			// If the fraction randomly winds up outside of (0.0-1.0), clamp
 			// back down to the VaultLeaseRenewalThreshold provided by the user,
@@ -209,9 +211,19 @@ func leaseCheckWait(s *Secret, retryCount int) time.Duration {
 }
 
 // jitter adds randomness to a duration to prevent thundering herd.
-// It reduces the duration by up to maxJitter (10%) randomly.
+// It reduces the duration by up to maxJitter (10%) randomly using crypto/rand.
+// using this to fix CWE-338: Use of Cryptographically Secure Pseudo-Random Number Generator (CSPRNG)
 func jitter(t time.Duration) time.Duration {
-	f := float64(t) * (1.0 - maxJitter*rand.Float64())
+	// Generate cryptographically secure random value between 0.0 and 1.0
+	max := big.NewInt(1000000)
+	n, err := cryptorand.Int(cryptorand.Reader, max)
+	if err != nil {
+		// Fallback to no jitter if crypto/rand fails
+		log.Printf("[WARN] Failed to generate secure random jitter: %v", err)
+		return t
+	}
+	randomFloat := float64(n.Int64()) / 1000000.0
+	f := float64(t) * (1.0 - maxJitter*randomFloat)
 	return time.Duration(f)
 }