Claude
c647191a79
Security improvements: Fix crypto RNG and add security audit
Comprehensive security analysis and fixes addressing multiple
vulnerabilities identified in code and dependencies.
Security Fixes:
- LS47: Replace Math.random() with crypto.getRandomValues() for padding
- GOST: Add warning when falling back to insecure Math.random()
- Both maintain backward compatibility with graceful fallbacks
Documentation:
- SECURITY_ANALYSIS.md: Comprehensive audit of 35 npm vulnerabilities
- SECURITY_FIXES_APPLIED.md: Detailed changelog of all security improvements
- scripts/security-fix.sh: Automated dependency update script
Key Findings:
- 35 npm vulnerabilities (8 critical, 8 high, 11 moderate, 8 low)
- Critical: eval() usage in OutputWaiter.mjs (requires review)
- Medium: 20+ innerHTML usages (most properly escaped)
- Low: Math.random() in crypto contexts (now fixed)
Recommendations:
1. Run ./scripts/security-fix.sh to update dependencies
2. Review eval() usage for CSP implementation
3. Audit innerHTML sources in App.mjs
4. Enable automated security scanning (Dependabot/Snyk)
Impact:
- Improved cryptographic security in LS47 and GOST operations
- Better visibility of fallback RNG usage
- Clear security documentation for maintainers
- Automated tools for dependency management
All changes are backward compatible with graceful degradation.