FJamil915108 (Community Member) asked a question.
What are compatible libraries for fixing CWE 331?
Veracode reports a flaw for the following code which uses RandomStringUtils.random from Apache Commons lang with SecureRandom:
private static final SecureRandom RANDOM = new SecureRandom();
public static String generateRandomAlphaNumeric(int length) {
return RandomStringUtils.random(length, 0, 0, true, true, null, RANDOM);
}
It seems that RandomStringUtils.random is automatically reported as having insufficient entropy by the Veracode scan. What other library alternatives work for fixing this flaw?
.png){kind=logo}
Hi @FJamil915108 (Community Member) ,
The only library that Veracode Static Analysis accepts for closing CWE 331 in Java is that one: https://docs.oracle.com/javase/8/docs/api/java/security/SecureRandom.html.
In your use case, you are telling `RandomStringUtils.random` to use `SecureRandom` as a source of entropy. However, simply using `SecureRandom` as a source of entropy is just one piece of the puzzle to generating a CSPRNG. There are many more caveats involved in how this randomness would be further used by an API. At this point, `RandomStringUtils.random` is not a blessed function by Veracode Research and we would recommend using the "pure" `SecureRandom` instead, as described here: https://www.veracode.com/blog/research/cryptographically-secure-pseudo-random-number-generator-csprng.
Alternatively, if the random number you are generating is not security-sensitive, I would recommend proposing a mitigation and discussing it with your organization's Security Team. For more information on how to propose a mitigation, please refer to https://docs.veracode.com/r/improve_mitigation.
Thank you
Florian Walter