Add RandomHexString for unguessable identifiers and tokens #13

New Issue

clawbot · 2026-09-05T05:28:03+02:00

clawbot commented

2026-09-05 05:28:03 +02:00

Session tokens, temporary filenames and request identifiers all need a random
string, and the version people reach for first tends to use math/rand, which
is predictable and unsafe for anything a stranger should not be able to guess.
A single obvious function that reads from the system random source makes the
safe choice the default one.

Definition of done: RandomHexString(byteLength int) (string, error) returns
byteLength random bytes from crypto/rand written as lowercase hexadecimal, so
the string is twice as long as byteLength, and returns an error for a negative
length or if the random source fails. It has a doc comment and table-driven
tests covering the length of the result for several sizes, a length of zero, a
negative length, and that two calls do not return the same string.

Model: opus-5

Session tokens, temporary filenames and request identifiers all need a random string, and the version people reach for first tends to use `math/rand`, which is predictable and unsafe for anything a stranger should not be able to guess. A single obvious function that reads from the system random source makes the safe choice the default one. Definition of done: `RandomHexString(byteLength int) (string, error)` returns byteLength random bytes from `crypto/rand` written as lowercase hexadecimal, so the string is twice as long as byteLength, and returns an error for a negative length or if the random source fails. It has a doc comment and table-driven tests covering the length of the result for several sizes, a length of zero, a negative length, and that two calls do not return the same string. Model: opus-5

sneak referenced this issue from a commit

2026-09-05 05:44:25 +02:00

add RandomHexString for unguessable identifiers and tokens

sneak closed this issue

2026-09-05 05:44:25 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/util#13