RTECH/notXCS
2
0
Fork 0
Code Issues Pull requests 1 Actions Packages Projects Releases Wiki Activity

Fix biased random API key generation and improve review feedback

Browse source
This commit is contained in:
copilot-swe-agent[bot] 2026-07-02 15:54:57 +00:00 committed by GitHub
parent 8e69420295
commit a1ee29a1b8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 16 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lib/generators.js
View file

@ -10,11 +10,12 @@ function generatePlaceId() {
} }
// Generates a random alphanumeric+symbol API key of the given length (default 64 characters). // Generates a random alphanumeric+symbol API key of the given length (default 64 characters).
// Uses crypto.randomInt for unbiased selection of each character (rather than bytes % length,
// which would skew towards characters at the start of the alphabet).
function generateApiKey(length = API_KEY_LENGTH) { function generateApiKey(length = API_KEY_LENGTH) {
const bytes = crypto.randomBytes(length);
let key = ''; let key = '';
for (let i = 0; i < length; i++) { for (let i = 0; i < length; i++) {
key += API_KEY_CHARS[bytes[i] % API_KEY_CHARS.length]; key += API_KEY_CHARS[crypto.randomInt(API_KEY_CHARS.length)];
} }
return key; return key;
} }

7
public/js/dashboard.js
View file

@ -241,11 +241,16 @@ document.getElementById('toggle-api-key-btn').addEventListener('click', () => {
document.getElementById('copy-api-key-btn').addEventListener('click', async () => { document.getElementById('copy-api-key-btn').addEventListener('click', async () => {
const value = document.getElementById('place-api-key-display').value; const value = document.getElementById('place-api-key-display').value;
if (!value) return; if (!value) return;
const btn = document.getElementById('copy-api-key-btn');
const originalLabel = btn.textContent;
try { try {
await navigator.clipboard.writeText(value); await navigator.clipboard.writeText(value);
btn.textContent = 'Copied!';
} catch (err) { } catch (err) {
// Clipboard API may be unavailable; fail silently. btn.textContent = 'Copy failed';
} }
setTimeout(() => { btn.textContent = originalLabel; }, 1500);
}); });
document.getElementById('regenerate-api-key-btn').addEventListener('click', async () => { document.getElementById('regenerate-api-key-btn').addEventListener('click', async () => {

9
routes/dashboard.js
View file

@ -103,8 +103,13 @@ router.post('/places', (req, res) => {
return res.status(403).json({ success: false, message: "Only admins can set a custom place id or API key" }); return res.status(403).json({ success: false, message: "Only admins can set a custom place id or API key" });
} }
id = canSetCustomValues && id ? String(id).trim() : ''; if (!canSetCustomValues) {
apiKey = canSetCustomValues && apiKey ? String(apiKey).trim() : ''; id = '';
apiKey = '';
} else {
id = id ? String(id).trim() : '';
apiKey = apiKey ? String(apiKey).trim() : '';
}
if (!id) id = generatePlaceId(); if (!id) id = generatePlaceId();
if (!apiKey) apiKey = generateApiKey(); if (!apiKey) apiKey = generateApiKey();