Skip to content

Commit e49a4d9

Browse files
karesclaude
andcommitted
pseudo_bytes should use SecureRandom to match CRuby behavior
CRuby's OpenSSL::Random.pseudo_bytes is an alias for random_bytes (both call RAND_bytes). JRuby was using java.util.Random which is not cryptographically secure, silently weakening randomness for applications porting from CRuby. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 4cfc333 commit e49a4d9

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

src/main/java/org/jruby/ext/openssl/Random.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,8 @@ private static RubyString random_bytes(final ThreadContext context,
289289
@JRubyMethod(meta = true)
290290
public static RubyString pseudo_bytes(final ThreadContext context,
291291
final IRubyObject self, final IRubyObject len) {
292-
return generate(context, self, toInt(context.runtime, len), false); // plain-random
292+
// NOTE: CRuby's pseudo_bytes is an alias for random_bytes (both use RAND_bytes)
293+
return generate(context, self, toInt(context.runtime, len), true); // secure-random
293294
}
294295

295296
private static int toInt(final Ruby runtime, final IRubyObject arg) {

0 commit comments

Comments
 (0)