Merge pull request #10431 from growilabs/copilot/fix-codeql-issues-except-polynomial-regex

fix: CodeQL security issues: insecure randomness and unvalidated redirect

apps/app/src/server/models/user.js

@@ -125,8 +125,8 @@ const factory = (crowi) => {
     const len = 12;
 
     for (let i = 0; i < len; i++) {
-      const randomPoz = Math.floor(Math.random() * chars.length);
-      password += chars.substring(randomPoz, randomPoz + 1);
+      const randomIndex = crypto.randomInt(0, chars.length);
+      password += chars[randomIndex];
     }
 
     return password;
@@ -567,8 +567,8 @@ const factory = (crowi) => {
     const newUser = new User();
 
     /* eslint-disable newline-per-chained-call */
-    const tmpUsername = `temp_${Math.random().toString(36).slice(-16)}`;
-    const password = Math.random().toString(36).slice(-16);
+    const tmpUsername = `temp_${crypto.randomBytes(8).toString('hex')}`;
+    const password = crypto.randomBytes(12).toString('hex');
     /* eslint-enable newline-per-chained-call */
 
     newUser.username = tmpUsername;

apps/app/src/server/routes/login-passport.js

@@ -78,7 +78,7 @@ module.exports = function(crowi, app) {
     const redirectTo = redirectToForUnauthenticated ?? res.locals.redirectTo ?? '/';
 
     if (isExternalAccount) {
-      return res.redirect(redirectTo);
+      return res.safeRedirect(redirectTo);
     }
 
     return res.apiv3({ redirectTo });