|
| 1 | +package internalclient |
| 2 | + |
| 3 | +// NOTE: Code adapted from github.com/labstack/echo/[email protected]/middleware/util.go. |
| 4 | + |
| 5 | +import ( |
| 6 | + "bufio" |
| 7 | + "crypto/rand" |
| 8 | + "io" |
| 9 | + "sync" |
| 10 | +) |
| 11 | + |
| 12 | +// https://tip.golang.org/doc/go1.19#:~:text=Read%20no%20longer%20buffers%20random%20data%20obtained%20from%20the%20operating%20system%20between%20calls |
| 13 | +var randomReaderPool = sync.Pool{New: func() interface{} { |
| 14 | + return bufio.NewReader(rand.Reader) |
| 15 | +}} |
| 16 | + |
| 17 | +const ( |
| 18 | + randomStringCharset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" |
| 19 | + randomStringCharsetLen = 52 // len(randomStringCharset) |
| 20 | + randomStringMaxByte = 255 - (256 % randomStringCharsetLen) |
| 21 | +) |
| 22 | + |
| 23 | +func randomString(length uint8) string { |
| 24 | + reader := randomReaderPool.Get().(*bufio.Reader) |
| 25 | + defer randomReaderPool.Put(reader) |
| 26 | + |
| 27 | + b := make([]byte, length) |
| 28 | + r := make([]byte, length+(length/4)) // perf: avoid read from rand.Reader many times |
| 29 | + var i uint8 = 0 |
| 30 | + |
| 31 | + // security note: |
| 32 | + // we can't just simply do b[i]=randomStringCharset[rb%len(randomStringCharset)], |
| 33 | + // len(len(randomStringCharset)) is 52, and rb is [0, 255], 256 = 52 * 4 + 48. |
| 34 | + // make the first 48 characters more possibly to be generated then others. |
| 35 | + // So we have to skip bytes when rb > randomStringMaxByte |
| 36 | + |
| 37 | + for { |
| 38 | + _, err := io.ReadFull(reader, r) |
| 39 | + if err != nil { |
| 40 | + panic("unexpected error happened when reading from bufio.NewReader(crypto/rand.Re der)") |
| 41 | + } |
| 42 | + for _, rb := range r { |
| 43 | + if rb > randomStringMaxByte { |
| 44 | + // Skip this number to avoid bias. |
| 45 | + continue |
| 46 | + } |
| 47 | + b[i] = randomStringCharset[rb%randomStringCharsetLen] |
| 48 | + i++ |
| 49 | + if i == length { |
| 50 | + return string(b) |
| 51 | + } |
| 52 | + } |
| 53 | + } |
| 54 | +} |
0 commit comments