Improved session id random in meshrelay.js.
Ylian Saint-Hilaire committed
Jul 18, 2022 at 22:56 UTC
49cac98430dcce9c719acef606ee91099c24edfd
1 file changed
+4
-5
meshrelay.js
+4
-5
@@ -879,7 +879,7 @@ function CreateMeshRelayEx(parent, ws, req, domain, user, cookie) {
879
const rcookieData = {};
880
if (user != null) { rcookieData.ruserid = user._id; } else if (obj.nouser === true) { rcookieData.nouser = 1; }
881
const rcookie = parent.parent.encodeCookie(rcookieData, parent.parent.loginCookieEncryptionKey);
882
- if (obj.id == null) { obj.id = ('' + Math.random()).substring(2); } // If there is no connection id, generate one.
882
+ if (obj.id == null) { obj.id = parent.crypto.randomBytes(9).toString('base64'); } // If there is no connection id, generate one.
883
const command = { nodeid: cookie.nodeid, action: 'msg', type: 'tunnel', value: '*/' + xdomain + 'meshrelay.ashx?id=' + obj.id + '&rauth=' + rcookie, tcpport: cookie.tcpport, tcpaddr: cookie.tcpaddr, soptions: {} };
884
if (user) { command.userid = user._id; }
885
if (typeof domain.consentmessages == 'object') {
@@ -915,9 +915,8 @@ function CreateMeshRelayEx(parent, ws, req, domain, user, cookie) {
915
obj.meshid = node.meshid;
916
917
// Send connection request to agent
918
- if (obj.id == null) { obj.id = ('' + Math.random()).substring(2); } // If there is no connection id, generate one.
918
+ if (obj.id == null) { obj.id = parent.crypto.randomBytes(9).toString('base64'); } // If there is no connection id, generate one.
919
const rcookie = parent.parent.encodeCookie({ ruserid: user._id }, parent.parent.loginCookieEncryptionKey);
920
-
920
if (obj.req.query.tcpport != null) {
921
const command = { nodeid: obj.req.query.nodeid, action: 'msg', type: 'tunnel', userid: user._id, value: '*/' + xdomain + 'meshrelay.ashx?id=' + obj.id + '&rauth=' + rcookie, tcpport: obj.req.query.tcpport, tcpaddr: ((obj.req.query.tcpaddr == null) ? '127.0.0.1' : obj.req.query.tcpaddr), soptions: {} };
922
if (typeof domain.consentmessages == 'object') {
@@ -972,7 +971,7 @@ function CreateMeshRelayEx(parent, ws, req, domain, user, cookie) {
971
obj.meshid = node.meshid;
972
973
// Send connection request to agent
975
- if (obj.id == null) { obj.id = ('' + Math.random()).substring(2); }
974
+ if (obj.id == null) { obj.id = parent.crypto.randomBytes(9).toString('base64'); } // If there is no connection id, generate one.
975
const rcookieData = { nodeid: node._id };
976
if (user != null) { rcookieData.ruserid = user._id; } else if (obj.nouser === true) { rcookieData.nouser = 1; }
977
const rcookie = parent.parent.encodeCookie(rcookieData, parent.parent.loginCookieEncryptionKey);
@@ -1118,7 +1117,7 @@ module.exports.CreateLocalRelay = function (parent, ws, req, domain, user, cooki
1117
function CreateLocalRelayEx(parent, ws, req, domain, user, cookie) {
1118
const net = require('net');
1119
var obj = {};
1121
- obj.id = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
1120
+ obj.id = parent.crypto.randomBytes(9).toString('base64');
1121
obj.req = req;
1122
obj.ws = ws;
1123
obj.user = user;