From eac54c6f4395396ec5cc6d2b221020e3a899b7cb Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 19 Dec 2022 14:39:00 +0100
Subject: [PATCH] Enhanced randomness when generating a `serialNumber`

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 HISTORY.md      |  3 +++
 src/builders.ts | 15 ++++++++++++---
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 1e8b7e514..8515d4a05 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -4,10 +4,13 @@ All notable changes to this project will be documented in this file.
 
 ## unreleased
 
+* Changed
+  * Enhanced randomness when generating a `serialNumber` (via [#389])
 * Build
   * Use _TypeScript_ `v4.9.4` now, was `v4.9.3` (via [#366])
 
 [#366]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/366
+[#389]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/389
 
 ## 1.7.1 - 2022-12-16
 
diff --git a/src/builders.ts b/src/builders.ts
index 71487ba78..3183f5c52 100644
--- a/src/builders.ts
+++ b/src/builders.ts
@@ -479,9 +479,18 @@ export class BomBuilder {
   }
 
   private makeRandomSerialNumber (): string {
-    const b = [0, 1, 2, 3, 4, 5, 6, 7].map(() => Math.round(Math.random() * 0xFFFF))
-    b[3] = b[3] & 0x0FFF | 0x4000 // UUID version 4
-    b[4] = b[4] & 0x3FFF | 0x8000 // UUID version 4 variant 1
+    const b = [
+      Math.round(Math.random() * 0xFFFF),
+      Math.round(Math.random() * 0xFFFF),
+      Math.round(Math.random() * 0xFFFF),
+      // UUID version 4
+      Math.round(Math.random() * 0x0FFF) | 0x4000,
+      // UUID version 4 variant 1
+      Math.round(Math.random() * 0x3FFF) | 0x8000,
+      Math.round(Math.random() * 0xFFFF),
+      Math.round(Math.random() * 0xFFFF),
+      Math.round(Math.random() * 0xFFFF)
+    ]
     const s = b.map(n => n.toString(16).padStart(4, '0'))
     return `urn:uuid:${s[0]}${s[1]}-${s[2]}-${s[3]}-${s[4]}-${s[5]}${s[6]}${s[7]}`
   }