xdp_mkstempat uses extremely poor PRNG

[setharnold]

xdg-desktop-portal/src/xdp-utils.c

Line 69 in d4a92e0

/* Get some more or less random data. */

Hello,

I noticed that xdp_mkstempat() uses a really poor PRNG. Since the mkstemp() family of functions is used primarily for generating filenames that are extremely difficult for an attacker to collide, I believe this function should be using a significantly stronger RNG, preferably getrandom(2) if new-enough Linux is the target OS, or /dev/urandom if new-enough unix-alike is the target OS.

Thanks

[matthiasclasen]

I don't think it matters here.

[matthiasclasen]

Fixing this should probably start at the source - this code is more or less copied from glib, which is more or less copied from glibc...

[GeorgesStavracas]

Seems like not to be under anyone's radar. As Matthias mentions, it's just copying other more security sensitive places.