Repository navigation
fix(bot): use crypto.randomInt for giveaway winners, suppress ReDoS false positive - #811
Conversation
…alse positive Replace Math.random() with crypto.randomInt() for CSPRNG-backed winner selection. Suppress S5852 on non-backtracking regex /(\d+)([hmd])/g.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Rate limit exceeded
To continue reviewing without waiting, purchase usage credits in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
…alse positive (#811) Replace Math.random() with crypto.randomInt() for CSPRNG-backed winner selection. Suppress S5852 on non-backtracking regex /(\d+)([hmd])/g.
Summary
Math.floor(Math.random() * entries.length)withcrypto.randomInt(entries.length)(Node.js built-in CSPRNG) for giveaway winner selection — fixes SonarCloud S2245 (Weak Cryptography hotspot)// NOSONAR: S5852comment on/(\d+)([hmd])/gregex —\d+and[hmd]are non-overlapping character classes with no catastrophic backtracking path (false positive)Why
Three SonarCloud security hotspots in
giveaway.tsare causing theSonarCloud Code Analysischeck to fail on main after PR #805 merged. This PR resolves all three.Test plan
SonarCloud Code Analysischeck turns green on main