fixing cwe-338 on other places to address race test failure

Author: aswanidutt

child/child.go

@@ -4,11 +4,12 @@
 package child
 
 import (
+	cryptorand "crypto/rand"
 	"errors"
 	"fmt"
 	"io"
 	"log"
-	"math/rand"
+	"math/big"
 	"os"
 	"os/exec"
 	"strings"
@@ -475,8 +476,15 @@ func (c *Child) randomSplay() <-chan time.Time {
 	}
 
 	ns := c.splay.Nanoseconds()
-	offset := rand.Int63n(ns)
-	t := time.Duration(offset)
+	// Use crypto/rand for secure random generation (CWE-338 fix)
+	max := big.NewInt(ns)
+	n, err := cryptorand.Int(cryptorand.Reader, max)
+	if err != nil {
+		// Fallback to no splay if crypto/rand fails
+		log.Printf("[WARN] (child) failed to generate secure random splay: %v", err)
+		return time.After(0)
+	}
+	t := time.Duration(n.Int64())
 
 	c.logger.Printf("[DEBUG] (child) waiting %.2fs for random splay", t.Seconds())
 

dependency/vault_common.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"log"
 	"math/big"
-	mathrand "math/rand"
 	"sync"
 	"time"
 
@@ -187,15 +186,15 @@ func leaseCheckWait(s *Secret, retryCount int) time.Duration {
 		sleep = sleep / 3.0
 
 		// Use some randomness so many clients do not hit Vault simultaneously.
-		sleep = sleep * (mathrand.Float64() + 1) / 2.0
+		sleep = sleep * (secureRandomFloat64() + 1) / 2.0
 	} else if !rotatingSecret {
 		// If the secret doesn't have a rotation period, this is a non-renewable leased
 		// secret.
 		// For non-renewable leases set the renew duration to use much of the secret
 		// lease as possible. Use a stagger over the configured threshold
 		// fraction of the lease duration so that many clients do not hit
 		// Vault simultaneously.
-		finalFraction := VaultLeaseRenewalThreshold + (mathrand.Float64()-0.5)*0.1
+		finalFraction := VaultLeaseRenewalThreshold + (secureRandomFloat64()-0.5)*0.1
 		if finalFraction >= 1.0 || finalFraction <= 0.0 {
 			// If the fraction randomly winds up outside of (0.0-1.0), clamp
 			// back down to the VaultLeaseRenewalThreshold provided by the user,
@@ -210,19 +209,24 @@ func leaseCheckWait(s *Secret, retryCount int) time.Duration {
 	return time.Duration(sleep)
 }
 
-// jitter adds randomness to a duration to prevent thundering herd.
-// It reduces the duration by up to maxJitter (10%) randomly using crypto/rand.
-// using this to fix CWE-338: Use of Cryptographically Secure Pseudo-Random Number Generator (CSPRNG)
-func jitter(t time.Duration) time.Duration {
-	// Generate cryptographically secure random value between 0.0 and 1.0
+// secureRandomFloat64 generates a cryptographically secure random float64 in [0.0, 1.0).
+// This is thread-safe and used to fix CWE-338.
+func secureRandomFloat64() float64 {
 	max := big.NewInt(1000000)
 	n, err := cryptorand.Int(cryptorand.Reader, max)
 	if err != nil {
-		// Fallback to no jitter if crypto/rand fails
-		log.Printf("[WARN] Failed to generate secure random jitter: %v", err)
-		return t
+		// Fallback to 0.5 if crypto/rand fails (rare but possible)
+		log.Printf("[WARN] Failed to generate secure random number: %v", err)
+		return 0.5
 	}
-	randomFloat := float64(n.Int64()) / 1000000.0
+	return float64(n.Int64()) / 1000000.0
+}
+
+// jitter adds randomness to a duration to prevent thundering herd.
+// It reduces the duration by up to maxJitter (10%) randomly using crypto/rand.
+// This function is thread-safe.
+func jitter(t time.Duration) time.Duration {
+	randomFloat := secureRandomFloat64()
 	f := float64(t) * (1.0 - maxJitter*randomFloat)
 	return time.Duration(f)
 }

watch/view.go

@@ -4,10 +4,11 @@
 package watch
 
 import (
+	cryptorand "crypto/rand"
 	"errors"
 	"fmt"
 	"log"
-	"math/rand"
+	"math/big"
 	"reflect"
 	"sync"
 	"time"
@@ -311,7 +312,15 @@ const minDelayBetweenUpdates = time.Millisecond * 100
 func rateLimiter(start time.Time) time.Duration {
 	remaining := minDelayBetweenUpdates - time.Since(start)
 	if remaining > 0 {
-		dither := time.Duration(rand.Int63n(20000000)) // 0-20ms
+		// Use crypto/rand for secure random generation (CWE-338 fix)
+		max := big.NewInt(20000000) // 0-20ms in nanoseconds
+		n, err := cryptorand.Int(cryptorand.Reader, max)
+		if err != nil {
+			// Fallback to no dither if crypto/rand fails
+			log.Printf("[WARN] (view) failed to generate secure random dither: %v", err)
+			return remaining
+		}
+		dither := time.Duration(n.Int64())
 		return remaining + dither
 	}
 	return 0