Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use SecureRandom instead of Random for Metrics #3495

Merged
merged 2 commits into from
Jun 21, 2024
Merged

Use SecureRandom instead of Random for Metrics #3495

merged 2 commits into from
Jun 21, 2024

Conversation

markushi
Copy link
Member

📜 Description

In order to not get flagged by security scanners we should use SecureRandom in favor of Random. Whilst the use-case (random flush shift) doesn't really require a strong random, I guess it's maintenance-friendlier to use SecureRandom.

💡 Motivation and Context

Fixes getsentry/sentry-react-native#3897

💚 How did you test it?

📝 Checklist

  • I reviewed the submitted code.
  • I added tests to verify the changes.
  • No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
  • I updated the docs if needed.
  • Review from the native team if needed.
  • No breaking change or entry added to the changelog.
  • No breaking change for hybrid SDKs or communicated to hybrid SDKs.

🔮 Next steps

@markushi markushi mentioned this pull request Jun 18, 2024
Closed
11 tasks
krystofwoldrich
krystofwoldrich approved these changes Jun 18, 2024
View reviewed changes
Copy link
Member

@krystofwoldrich krystofwoldrich left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

Thank you for the quick PR.

@github-actions GitHub Actions
Copy link
Contributor

Performance metrics 🚀

  Plain With Sentry Diff
Startup time 404.90 ms 480.93 ms 76.04 ms
Size 1.70 MiB 2.28 MiB 592.47 KiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
d6d2b2e 463.14 ms 545.56 ms 82.42 ms
a3c77bc 375.80 ms 445.85 ms 70.06 ms
c7e2fbc 377.85 ms 426.35 ms 48.50 ms
f5e1b97 362.53 ms 429.31 ms 66.78 ms
7eccfdb 389.94 ms 461.29 ms 71.35 ms
f1fdb9f 404.21 ms 496.87 ms 92.66 ms
28c9a83 346.14 ms 377.76 ms 31.62 ms
baaf637 375.71 ms 441.58 ms 65.87 ms
283d83e 348.44 ms 392.06 ms 43.62 ms
61981dc 388.65 ms 454.96 ms 66.31 ms

App size

Revision Plain With Sentry Diff
d6d2b2e 1.72 MiB 2.27 MiB 555.05 KiB
a3c77bc 1.72 MiB 2.29 MiB 577.53 KiB
c7e2fbc 1.72 MiB 2.29 MiB 576.40 KiB
f5e1b97 1.70 MiB 2.28 MiB 592.00 KiB
7eccfdb 1.72 MiB 2.27 MiB 556.93 KiB
f1fdb9f 1.70 MiB 2.28 MiB 592.08 KiB
28c9a83 1.70 MiB 2.28 MiB 592.00 KiB
baaf637 1.72 MiB 2.27 MiB 558.42 KiB
283d83e 1.72 MiB 2.29 MiB 577.69 KiB
61981dc 1.70 MiB 2.28 MiB 592.12 KiB

@kahest
Copy link
Member

kahest commented Jun 18, 2024

@markushi is this on a hot path / do we know if/how much SecureRandom is slower than Random?

@markushi
Copy link
Member Author

markushi commented Jun 18, 2024 •
edited
Loading

@markushi is this on a hot path / do we know if/how much SecureRandom is slower than Random?

It's only computed once during class init and we access SecureRandom here and here already during app start.

I also tried to run it on a test device, takes <1ms to execute.

final long totalDurationNanos = 0;
final int n = 1000;
for (int i = 0; i < n; i++) {
	final long start = System.nanoTime();
	final double value = new SecureRandom().nextFloat();
	totalDurationNanos += System.nanoTime() - start;
}
Log.d("Test", "took " + TimeUnit.NANOSECONDS.toMillis(totalDurationNanos) + "ms to generate " + n + " items.");


// took 129ms to generate 1000 items.

@markushi markushi merged commit 75bfb8b into main Jun 21, 2024
25 checks passed
@markushi markushi deleted the fix/metrics-random-usage branch June 21, 2024 11:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@krystofwoldrich krystofwoldrich krystofwoldrich approved these changes

@kahest kahest kahest approved these changes

@adinauer adinauer Awaiting requested review from adinauer adinauer is a code owner

@romtsn romtsn Awaiting requested review from romtsn romtsn is a code owner

@stefanosiano stefanosiano Awaiting requested review from stefanosiano stefanosiano is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

CWE-330: Use of Insufficiently Random Values in MetricsHelper.java
3 participants
@markushi @kahest @krystofwoldrich