Metadata

ID: dart-security/insecure-random-seed

Language: Dart

Severity: Warning

Category: Security

CWE: 335

Description

Constructing Random with a hardcoded integer seed makes the entire sequence of generated values fully predictable and reproducible by anyone who reads the source code.

Never seed a PRNG with a constant. Use Random() for non-security contexts or Random.secure() for cryptographic purposes, both of which use unpredictable seed sources.

Non-Compliant Code Examples

import 'dart:math';

void main() {
  final r1 = Random(0);
  final r2 = Random(42);
}

import 'dart:math';

void main() {
  final r = Random(0xFF);
}

Compliant Code Examples

import 'dart:math';

void main() {
  final r = Random();
  print(r.nextInt(100));
}

import 'dart:math';

void main() {
  final r = Random.secure();
  print(r.nextInt(100));
}

import 'dart:math';

void main(int seed) {
  final r = Random(seed);
  print(r.nextInt(100));
}

Seamless integrations. Try Datadog Code Security

Datadog Code Security