Skip to content

Conversation

@skjnldsv
Copy link
Member

On tests, we have a non-secure env (HTTP), some users might also use without ssl on their local instances

@skjnldsv skjnldsv self-assigned this Jun 21, 2025
@skjnldsv skjnldsv requested a review from a team as a code owner June 21, 2025 08:10
@skjnldsv skjnldsv added the bug label Jun 21, 2025
@skjnldsv skjnldsv requested review from susnux and removed request for a team June 21, 2025 08:10
@skjnldsv skjnldsv added the 3. to review Waiting for reviews label Jun 21, 2025
@skjnldsv skjnldsv requested review from nfebe and szaimen June 21, 2025 08:10
@szaimen szaimen removed their request for review June 21, 2025 08:58
* @param {Uint8Array} array - The array to fill with random values.
*/
function getRandomValues(array: Uint8Array): void {
if (self?.crypto?.getRandomValues) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if (self?.crypto?.getRandomValues) {
if (self.crypto?.getRandomValues) {

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Eehehe I thought self could also be undefined sometimes 🤭🤭
I guess we're adamant this is the browser anyway so yeah, maybe not needed 😊

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you expect self to be undefined, then just use globalThis instead ;)

@susnux
Copy link
Contributor

susnux commented Jun 21, 2025

On tests, we have a non-secure env (HTTP)

HTTP is not the only source, IIRC we use localhost which also with HTTP is a secure env.

Nevertheless as long as we support non-https for users we should also fix this here.

@skjnldsv
Copy link
Member Author

HTTP is not the only source, IIRC we use localhost which also with HTTP is a secure env.

It failed on viewer cypress tests. I guess it's because of the docker IP ?🤔

Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
@skjnldsv skjnldsv force-pushed the fix/insecure-crypto-env branch from 04c9868 to 3cff9d8 Compare July 28, 2025 16:07
@skjnldsv
Copy link
Member Author

/compile

Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>
@nextcloud-command nextcloud-command requested a review from a team as a code owner July 28, 2025 17:08
@skjnldsv skjnldsv merged commit 33ddce4 into master Jul 28, 2025
124 checks passed
@skjnldsv skjnldsv deleted the fix/insecure-crypto-env branch July 28, 2025 17:52
@skjnldsv
Copy link
Member Author

/backport to stable31

@skjnldsv
Copy link
Member Author

/backport to stable30

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants