fix: generate event short IDs with crypto/rand instead of math/rand f…

server/db/db_test.go

@@ -6,8 +6,6 @@ import (
 	"time"
 
 	"schej.it/server/db"
-
-	"go.mongodb.org/mongo-driver/bson/primitive"
 )
 
 func TestGetDailyUserLogByDate(t *testing.T) {
@@ -17,7 +15,6 @@ func TestGetDailyUserLogByDate(t *testing.T) {
 func TestGenerateShortEventId(t *testing.T) {
 	db.Init()
 
-	objectId, _ := primitive.ObjectIDFromHex("6607d6409f96021811c0a55f")
-	id := db.GenerateShortEventId(objectId)
+	id := db.GenerateShortEventId()
 	fmt.Println(id)
 }

server/db/events.go

@@ -2,7 +2,8 @@ package db
 
 import (
 	"context"
-	"math/rand"
+	"crypto/rand"
+	"math/big"
 	"time"
 
 	"go.mongodb.org/mongo-driver/bson"
@@ -150,35 +151,35 @@ func GetEventsCreatedThisMonth(userId primitive.ObjectID) int {
 	return int(result)
 }
 
-// Returns a random unique short event id seeded by the actual event id
-func GenerateShortEventId(eventId primitive.ObjectID) string {
-	r := rand.New(rand.NewSource(eventId.Timestamp().Unix()))
+// Returns a cryptographically random short event id that is not already in use
+func GenerateShortEventId() string {
+	maxAttempts := 10
 
-	id := ""
-
-	letters := "23456789ABCDEFabcdef"
-	for i := 0; i < 5; i++ {
-		index := r.Intn(len(letters))
-		letter := letters[index : index+1]
-		id += letter
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		id := randomShortId()
+		if GetEventByShortId(id) == nil {
+			return id
+		}
 	}
 
-	i := 0
-	event := GetEventByShortId(id)
-	for event != nil && i < 5 {
-		// Event exists, keep on adding letters until event doesn't exist anymore, max of 5 more letters
-		index := r.Intn(len(letters))
-		letter := letters[index : index+1]
-		id += letter
-		event = GetEventByShortId(id)
-		i++
-	}
+	logger.StdErr.Panicln("Couldn't generate unique id")
+	return ""
+}
 
-	if event != nil {
-		logger.StdErr.Panicln("Couldn't generate unique id")
+func randomShortId() string {
+	letters := "23456789ABCDEFabcdef"
+	// Must stay <= 10. GetEventByEitherId treats longer ids as ObjectIDs
+	shortIdLen := 10
+	alphabetLen := big.NewInt(int64(len(letters)))
+	b := make([]byte, shortIdLen)
+	for i := range b {
+		n, err := rand.Int(rand.Reader, alphabetLen)
+		if err != nil {
+			logger.StdErr.Panicln(err)
+		}
+		b[i] = letters[n.Int64()]
 	}
-
-	return id
+	return string(b)
 }
 
 // Updates the name of a guest response
@@ -215,7 +216,7 @@ func GuestNameExists(eventId string, guestName string) bool {
 
 	// Check if the name is a valid ObjectID that corresponds to an existing user
 	// If so, block it to prevent conflicts
-	//NOTE: we're checking against ALL logged in users because in case we allowed this, and a user with an account tried to 
+	//NOTE: we're checking against ALL logged in users because in case we allowed this, and a user with an account tried to
 	// submit their availability, overwriting would happen and we'd lose data.
 	objectId, err := primitive.ObjectIDFromHex(guestName)
 	if err == nil {
@@ -227,7 +228,6 @@ func GuestNameExists(eventId string, guestName string) bool {
 		}
 	}
 
-
 	// For events, check EventResponsesCollection
 	eventObjectId, err := primitive.ObjectIDFromHex(event.Id.Hex())
 	if err != nil {

server/routes/events.go

@@ -138,7 +138,7 @@ func createEvent(c *gin.Context) {
 	}
 
 	// Generate short id
-	shortId := db.GenerateShortEventId(event.Id)
+	shortId := db.GenerateShortEventId()
 	event.ShortId = &shortId
 
 	// Schedule reminder emails if remindees array is not empty
@@ -1594,7 +1594,7 @@ func duplicateEvent(c *gin.Context) {
 	}
 
 	// Generate short id
-	shortId := db.GenerateShortEventId(event.Id)
+	shortId := db.GenerateShortEventId()
 	event.ShortId = &shortId
 
 	// Insert new event
@@ -1785,7 +1785,7 @@ func importEvent(c *gin.Context) {
 
 	// Create local event with new identity
 	newId := primitive.NewObjectID()
-	shortId := db.GenerateShortEventId(newId)
+	shortId := db.GenerateShortEventId()
 	numResponses := 0
 
 	remoteEvent.Id = newId