Forum Discussion

faizz_UI's avatar
faizz_UI
New Contributor
5 years ago

HP Fortify - Insecure Randomness

HP Fortify is flagging swagger-ui.js as insecure, citing Math.random() as "Insecure Randomness". I'm using Swagger UI v2.2.6. Has there been a fix or response for this?

 

Thanks!

Swagger UI
  • HKosova's avatar
    HKosova
    SmartBear Alumni (Retired)
    5 years ago

    Swagger UI v. 2.2.6 is a very old version (from 2016). Try the latest version, 3.32.4.

    • faizz_UI's avatar
      faizz_UI
      New Contributor
      5 years ago

      Version 3.32.4 uses Math.random() as well, which will warrant the HP Fortify warning as well. The code below is from swagger-ui-3.32.4\dist\swagger-ui.js

       

      function(e,t)
      {
          var n=0,r=Math.random();
          e.exports=function(e)
          {
              return"Symbol(".concat(void 0===e?"":e,")_",(++n+r).toString(36))
          }
      }
      • tlai's avatar
        tlai
        SmartBear Alumni (Retired)
        5 years ago

        Math.random() is a commonly used function and is present in many popular libraries. SwaggerUI does not generate security sensitive context such as passwords or api keys. Thus, this notice should be a non-issue with regards to SwaggerUI.