Fix CodeQL security issues: insecure randomness and unvalidated redirect

Co-authored-by: yuki-takei <1638767+yuki-takei@users.noreply.github.com>

apps/app/src/server/models/user.js

@@ -124,8 +124,9 @@ const factory = (crowi) => {
     let password = '';
     const len = 12;
 
+    const randomBytes = crypto.randomBytes(len);
     for (let i = 0; i < len; i++) {
-      const randomPoz = Math.floor(Math.random() * chars.length);
+      const randomPoz = randomBytes[i] % chars.length;
       password += chars.substring(randomPoz, randomPoz + 1);
     }
 
@@ -567,8 +568,8 @@ const factory = (crowi) => {
     const newUser = new User();
 
     /* eslint-disable newline-per-chained-call */
-    const tmpUsername = `temp_${Math.random().toString(36).slice(-16)}`;
-    const password = Math.random().toString(36).slice(-16);
+    const tmpUsername = `temp_${crypto.randomBytes(8).toString('hex')}`;
+    const password = crypto.randomBytes(12).toString('hex');
     /* eslint-enable newline-per-chained-call */
 
     newUser.username = tmpUsername;

apps/app/src/server/routes/login-passport.js

@@ -78,7 +78,7 @@ module.exports = function(crowi, app) {
     const redirectTo = redirectToForUnauthenticated ?? res.locals.redirectTo ?? '/';
 
     if (isExternalAccount) {
-      return res.redirect(redirectTo);
+      return res.safeRedirect(redirectTo);
     }
 
     return res.apiv3({ redirectTo });