Using a cryptographically weak pseudo-random number generator to generate a security-sensitive value

[ghoelzer-aws]

aws-lex-web-ui/lex-web-ui/src/lib/lex/client.js

Lines 60 to 62 in 94bd01d

	this.userId = userId ||
	'lex-web-ui-' +
	`${Math.floor((1 + Math.random()) * 0x10000).toString(16).substring(1)}`;

An AWS Customer using this solution reached out to me and identified these lines of code that are failing their internal code/security scan, using GitHub CodeQL. They are asking that the following recommendation be reviewed and suggested (or similar) remediation applied: Use a cryptographically secure pseudo-random number generator if the output is to be used in a security-sensitive context. For JavaScript on the NodeS platform, crypto.getRandombytes provides a cryptographically secure pseudo-random byte generator. For JavaScript in the browser, RandomSource.getRandomvalues provides a cryptographically secure pseudo-random number generator.

[atjohns]

Thanks, we will include this upgrade in our 0.20.3 release