From 7abb63f1f205d477bb1af30199d0ad916f3fd8b9 Mon Sep 17 00:00:00 2001 From: Andrew Morgan Date: Fri, 23 Jan 2026 15:18:55 +0000 Subject: [PATCH] Don't be cryptographically random! That's what you get for generating a random string function. --- .../synapse/synapse_guest_module/mas_admin_client.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/restricted-guests/synapse/synapse_guest_module/mas_admin_client.py b/modules/restricted-guests/synapse/synapse_guest_module/mas_admin_client.py index 60c03aa417..b7166887f5 100644 --- a/modules/restricted-guests/synapse/synapse_guest_module/mas_admin_client.py +++ b/modules/restricted-guests/synapse/synapse_guest_module/mas_admin_client.py @@ -5,7 +5,7 @@ import base64 import logging -import secrets +import random import string from typing import Any, Awaitable, Dict, Optional @@ -171,7 +171,7 @@ class MasAdminClient: """ length = 16 alphabet = string.ascii_letters + string.digits + "-" - return "".join(secrets.choice(alphabet) for _ in range(length)) + return "".join(random.choices(alphabet, k=length)) async def _post_urlencoded_get_json( self, url: str, data: Dict[str, str], headers: Dict[str, Any]