Quartznet: Insufficient Entropy in System.Random

[dbraaten42]

Quartz.Net is being flagged for using System.Random instead of a secure random number generator.
System.Random can be replaced by System.Security.Cryptography.RNGCryptoServiceProvider

http://cwe.mitre.org/data/definitions/331.html

Version: 6.2.1

Version: 6.2.1

Expected behavior

No security issues.

Actual behavior

Security issues flagged.

Steps to reproduce

Run a security scanner that doesn't like System.Random.

[dbraaten42]

I created a pull request to fix this issue. https://github.com/quartznet/quartznet/pull/552

[lahma]

Thanks for reporting this. May I ask what is flagging this? As you may know, Quartz.NET does not use random values to anything that would actually require strong entropy guarantees. Random values are only used for trigger ids and sleep times.

[dbraaten42]

The scanner does care that Quartz.Net is using System.Random in a perfectly ok manner, it is only flagging the use of a prohibited API. If you search for "static security scanner" it should be on the first page of results.

Thank you for responding.

[lahma]

PR merged, thank you.