forked from pool/perl-Net-Dropbox-API
Oliver Kurz
e8272210f6
- Add urandom.patch for secure tokens https://github.com/norbu09/Net--Dropbox/pull/20 CVE-2024-58036 bsc#1240884 OBS-URL: https://build.opensuse.org/request/show/1280950 OBS-URL: https://build.opensuse.org/package/show/devel:languages:perl/perl-Net-Dropbox-API?expand=0&rev=14
61 lines
1.5 KiB
Diff
61 lines
1.5 KiB
Diff
commit e3a854a4305004b1b930dcde16e609ebccc9d78b
|
|
Author: Tina Müller <cpan2@tinita.de>
|
|
Date: Wed May 28 16:21:08 2025 +0200
|
|
|
|
Use Crypt::URandom for generation of nonce
|
|
|
|
See https://nvd.nist.gov/vuln/detail/CVE-2024-58036
|
|
|
|
The result is a string of hex digits with the same length as before, 16.
|
|
|
|
diff --git a/Makefile.PL b/Makefile.PL
|
|
index 0865ac2..301aac2 100644
|
|
--- a/Makefile.PL
|
|
+++ b/Makefile.PL
|
|
@@ -12,7 +12,7 @@ requires 'JSON';
|
|
requires 'Mouse';
|
|
requires 'Encode';
|
|
requires 'Net::OAuth';
|
|
-requires 'Data::Random';
|
|
+requires 'Crypt::URandom';
|
|
requires 'common::sense';
|
|
requires 'File::Basename';
|
|
requires 'LWP::UserAgent';
|
|
diff --git a/lib/Net/Dropbox/API.pm b/lib/Net/Dropbox/API.pm
|
|
index bcdec21..3d53799 100644
|
|
--- a/lib/Net/Dropbox/API.pm
|
|
+++ b/lib/Net/Dropbox/API.pm
|
|
@@ -8,7 +8,7 @@ use Net::OAuth;
|
|
use LWP::UserAgent;
|
|
use URI;
|
|
use HTTP::Request::Common;
|
|
-use Data::Random qw(rand_chars);
|
|
+use Crypt::URandom qw(urandom);
|
|
use Encode;
|
|
|
|
=head1 NAME
|
|
@@ -382,7 +382,7 @@ Generate a different nonce for every request.
|
|
|
|
=cut
|
|
|
|
-sub nonce { join( '', rand_chars( size => 16, set => 'alphanumeric' )); }
|
|
+sub nonce { unpack("H*", urandom(8)); }
|
|
|
|
sub _talk {
|
|
my $self = shift;
|
|
diff --git a/t/nonce.t b/t/nonce.t
|
|
new file mode 100644
|
|
index 0000000..7be9762
|
|
--- /dev/null
|
|
+++ b/t/nonce.t
|
|
@@ -0,0 +1,9 @@
|
|
+use strict;
|
|
+use warnings;
|
|
+use Test::More;
|
|
+use Net::Dropbox::API;
|
|
+
|
|
+my $nonce = Net::Dropbox::API::nonce();
|
|
+like $nonce, qr{^[a-zA-Z0-9]{16}\z}, 'expected nonce content';
|
|
+
|
|
+done_testing;
|