-
-
Notifications
You must be signed in to change notification settings - Fork 208
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: replace uuid with prefixed string with schemaIdCounter #661
Conversation
test/uuid-v4.test.js
Fixed
let alwaysLength36 = true | ||
let validUUID4 = true | ||
for (let i = 0; i < 1e6; ++i) { | ||
const uuid = uuidV4() |
Check failure
Code scanning / CodeQL
Insecure randomness High test
Math.random()
This uses a cryptographically insecure random number generated at
Math.random()
This uses a cryptographically insecure random number generated at
Math.random()
This uses a cryptographically insecure random number generated at
Math.random()
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yeah, we dont need cryptographical secure random number generation. We are just using the uuid for internal ids of the merged schemas etc..
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would be extremely wary of this. Maybe schema ids are not super secretive, but the are meant to be globally unique and my uninformed guess is that Math.random
is too predictable.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For our use case it should be good enough.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I dont know why github bot resolved this conversiation. I think @jsumners thought is important but still I think it is neglectable.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just to try out to solve this silly code:
performance.now()
works on node and browses
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just curious, crypto.randomUUID
is using pre-allocated cache.
Is it common to have that large (128 times) of id generate which exceed the cache entropy?
I guess it is for faster uuid generation. Like randomInt. |
If you need a unique identifier for just one process, you can use a global progressive integer. |
I personally think that collision wise it is easier to use this uuid implementation, because an incrementing number could result in collisions if multiple compiled json stringify are concentrated in one function. I think this is the cheapest solution, while also keeping it somewhat unique. I dont think that collisions are possible. |
How? We don't support combining functions. |
I am worried that using just an incrementing number could result in some unexpected behavior in some dependent projects. Do we call then the internal schemas |
Adding an incremental counter + internal prefix name should work. |
Implemented accordingly. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
We dont need crypto randomUUID, because we are cool. We use an internal counter and a fsj specific prefic to generate the schema.id.
@Ethan-Arrowood
@inlet
Checklist
npm run test
andnpm run benchmark
and the Code of conduct