Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/secure random value generation #63

Merged

Conversation

BavyaMittal
Copy link
Contributor

Title: Replaced os.urandom with secrets.token_bytes for secure random value generation.

Summary:
This pull request replaces all occurrences of os.urandom with the secrets package to improve the security and readability of random value generation. The secrets package is specifically designed for cryptographic purposes, making it a more suitable choice for these use cases. All required imports for secrets have been added.

Testing:
Ran pytest tests/ to verify functionality. All existing tests pass except one, which fails due to exceeding the Hypothesis deadline. The failure is unrelated to these changes and can be addressed by increasing the Hypothesis deadline from 200ms to 500ms.

Error Details for Test:

hypothesis.errors.DeadlineExceeded: Test took 253.70ms, which exceeds the deadline of 200.00ms
Falsifying example: test_key_derivation_from_password(
    password='00000000',
  salt=b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00)

@BavyaMittal BavyaMittal marked this pull request as draft December 4, 2024 17:54
@BavyaMittal BavyaMittal marked this pull request as ready for review December 4, 2024 17:54
Copy link
Owner

@Veinar Veinar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @BavyaMittal 👋,

Everything looks great, the test using hypothesis is not yet fully validated and may cause problems, so don't bother ☺️.

I would just ask you to remove venv because it got into the commit, either by accident or by my bad instructions in CONTRIBUTING.md. And thank you, for your work, many thanks!

@Veinar Veinar linked an issue Dec 4, 2024 that may be closed by this pull request
@BavyaMittal
Copy link
Contributor Author

BavyaMittal commented Dec 4, 2024

Hi @Veinar Sure! I have deleted the required files.

Copy link
Owner

@Veinar Veinar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now it is perfect 🙌

@Veinar Veinar merged commit 210a2b2 into Veinar:develop Dec 4, 2024
4 checks passed
@Veinar
Copy link
Owner

Veinar commented Dec 4, 2024

Merged, and it will be used within next release!
Thank you @BavyaMittal once more 🙌

@codecov-commenter
Copy link

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

All modified and coverable lines are covered by tests ✅

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Files with missing lines Coverage Δ
envcloak/encryptor.py 96.11% <100.00%> (+0.03%) ⬆️
envcloak/generator.py 95.23% <100.00%> (+0.23%) ⬆️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Introduce more secure way of generating random values (replace os.urandom)
3 participants