Use SecureRandom instead of Random to implement a cryptographically s…

…trong random number (#448) Use SecureRandom instead of Random to implement a cryptographically strong random number
srikanth-lingala · Jul 5, 2022 · 9c7bb74 · 9c7bb74
1 parent ce99554
commit 9c7bb74
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/src/main/java/net/lingala/zip4j/tasks/AbstractModifyFileTask.java b/src/main/java/net/lingala/zip4j/tasks/AbstractModifyFileTask.java
@@ -15,7 +15,7 @@
 import java.util.Collections;
 import java.util.Comparator;
 import java.util.List;
-import java.util.Random;
+import java.security.SecureRandom;
 
 abstract class AbstractModifyFileTask<T> extends AsyncZipTask<T> {
 
@@ -24,7 +24,7 @@ abstract class AbstractModifyFileTask<T> extends AsyncZipTask<T> {
   }
 
   File getTemporaryFile(String zipPathWithName) {
-    Random random = new Random();
+    SecureRandom random = new SecureRandom();
     File tmpFile = new File(zipPathWithName + random.nextInt(10000));
 
     while (tmpFile.exists()) {

diff --git a/src/test/java/net/lingala/zip4j/io/inputstream/ZipInputStreamIT.java b/src/test/java/net/lingala/zip4j/io/inputstream/ZipInputStreamIT.java
@@ -27,7 +27,7 @@
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
-import java.util.Random;
+import java.security.SecureRandom;
 import java.util.Set;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
@@ -152,7 +152,7 @@ public void testExtractWithReadLengthGreaterThanButNotMultipleOf16WithZipCryptoA
 
   @Test
   public void testExtractWithRandomLengthWithAesAndDeflateCompression() throws IOException {
-    Random random = new Random();
+    SecureRandom random = new SecureRandom();
     File createZipFile = createZipFile(CompressionMethod.DEFLATE, true, EncryptionMethod.AES, AesKeyStrength.KEY_STRENGTH_256, PASSWORD);
     LocalFileHeader localFileHeader;
     int readLen;

diff --git a/src/test/java/net/lingala/zip4j/testutils/RandomInputStream.java b/src/test/java/net/lingala/zip4j/testutils/RandomInputStream.java
@@ -2,11 +2,11 @@
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.util.Random;
+import java.security.SecureRandom;
 
 public class RandomInputStream extends InputStream {
 
-  private static final Random RANDOM = new Random();
+  private static final SecureRandom RANDOM = new SecureRandom();
 
   private long remaining;
   private boolean streamClosed;