From 07dfb1255a6cef2c2f5e0365c6932c97e9bea7e4 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 22 Jun 2026 00:34:22 +0000 Subject: [PATCH] fix: #131 use SecureRandom for default wallet id generator WalletsIn(Path) now seeds its randomizer with java.security.SecureRandom instead of java.util.Random. The 48-bit LCG output of the previous default is recoverable from a handful of observed samples, letting an observer enumerate upcoming wallet ids and race the existence check in create(). The two-arg constructor that accepts an explicit Random is untouched, so tests injecting deterministic generators stay unchanged. Closes #131 --- src/main/java/io/zold/api/WalletsIn.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/main/java/io/zold/api/WalletsIn.java b/src/main/java/io/zold/api/WalletsIn.java index 82fcced..96a3ec9 100644 --- a/src/main/java/io/zold/api/WalletsIn.java +++ b/src/main/java/io/zold/api/WalletsIn.java @@ -8,6 +8,7 @@ import java.nio.file.FileSystems; import java.nio.file.Files; import java.nio.file.Path; +import java.security.SecureRandom; import java.util.Iterator; import java.util.Random; import org.cactoos.Scalar; @@ -56,7 +57,7 @@ public WalletsIn(final Path pth) { this( () -> pth, "z", - new Random() + new SecureRandom() ); }