codeql

Author: jonathanlab

apps/array/src/shared/utils/id.ts

@@ -1,7 +1,7 @@
+import { randomBytes } from "node:crypto";
+
 export function randomSuffix(length = 8): string {
-  return Math.random()
-    .toString(36)
-    .substring(2, 2 + length);
+  return randomBytes(length).toString("hex").substring(0, length);
 }
 
 export function generateId(prefix: string, length = 8): string {

packages/agent/src/adapters/claude/mcp-server.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import type {
   ClientCapabilities,
   TerminalOutputResponse,
@@ -719,7 +720,7 @@ export function replaceAndCalculateLocation(
   let currentContent = fileContent;
 
   // Use unique markers to track where replacements happen
-  const markerPrefix = `__REPLACE_MARKER_${Math.random().toString(36).substr(2, 9)}_`;
+  const markerPrefix = `__REPLACE_MARKER_${randomBytes(5).toString("hex")}_`;
   let markerCounter = 0;
   const markers: string[] = [];
 

packages/agent/src/worktree-manager.ts

@@ -1,4 +1,5 @@
 import { exec, execFile } from "node:child_process";
+import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { promisify } from "node:util";
@@ -523,7 +524,7 @@ export class WorktreeManager {
   }
 
   private randomElement<T>(array: T[]): T {
-    return array[Math.floor(Math.random() * array.length)];
+    return array[crypto.randomInt(array.length)];
   }
 
   generateWorktreeName(): string {