fix: replace crypto.randomUUID with fallback for non-secure contexts#136
fix: replace crypto.randomUUID with fallback for non-secure contexts#136mzazon wants to merge 3 commits intomatt1398:mainfrom
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request resolves critical functionality issues that arose when the application was accessed from non-secure contexts, such as over plain HTTP on a local area network. By implementing a robust UUID generation utility with a fallback mechanism, it ensures that core features like tab and pane creation, as well as notification trigger and SSH profile ID generation, function correctly regardless of the browser's security context. This significantly improves the application's accessibility and reliability in diverse deployment environments. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new generateUUID utility function that provides a fallback mechanism for crypto.randomUUID() to ensure UUID generation works reliably across different environments, including non-secure contexts. All existing direct calls to crypto.randomUUID() have been replaced with this new utility. A suggestion was made to use globalThis.crypto within the generateUUID function for improved robustness and portability.
| if (typeof crypto.randomUUID === 'function') { | ||
| return crypto.randomUUID(); | ||
| } | ||
|
|
||
| // Fallback: construct a v4 UUID from getRandomValues | ||
| const bytes = crypto.getRandomValues(new Uint8Array(16)); |
There was a problem hiding this comment.
For improved robustness and consistency, it's better to use globalThis.crypto. The optional chaining (?.) on randomUUID prevents a ReferenceError in environments where crypto might not be defined. Using globalThis is also more portable across different JavaScript environments (e.g. window, worker).
This also makes the usage consistent with the fallback path which will rely on globalThis.crypto.
| if (typeof crypto.randomUUID === 'function') { | |
| return crypto.randomUUID(); | |
| } | |
| // Fallback: construct a v4 UUID from getRandomValues | |
| const bytes = crypto.getRandomValues(new Uint8Array(16)); | |
| if (globalThis.crypto?.randomUUID) { | |
| return globalThis.crypto.randomUUID(); | |
| } | |
| // Fallback: construct a v4 UUID from getRandomValues | |
| const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16)); |
There was a problem hiding this comment.
I'll leave this as-is. This code only runs in browser renderers where crypto is always defined (it's been a web standard since IE 11). The typeof crypto.randomUUID === 'function' check already guards the missing method safely.
The globalThis.crypto?. suggestion is also inconsistent — it uses optional chaining on the check but not on the fallback (globalThis.crypto.getRandomValues()), so if crypto were somehow undefined, the fallback would throw instead of the feature-detect.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
✅ Files skipped from review due to trivial changes (2)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughAdds a centralized Changes
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
src/renderer/utils/uuid.ts (1)
12-25: Add a test that explicitly exercises the fallback path.Current coverage appears to validate only the
randomUUIDbranch. Please add a case whererandomUUIDis unavailable and assert v4 format/version/variant on the returned ID.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/renderer/utils/uuid.ts` around lines 12 - 25, Add a unit test that forces the fallback path in generateUUID by temporarily removing or mocking crypto.randomUUID (set to undefined) and then calling generateUUID(); assert the returned string matches UUID v4 format (8-4-4-4-12 hex groups), verify the version nibble is 4 (character at position corresponding to bytes[6] -> UUID segment 3) and the variant bits are 10xx (the high bits of the UUID segment 4), and restore/mock back crypto.randomUUID after the test; target the generateUUID function in src/renderer/utils/uuid.ts when writing this test.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/renderer/types/tabs.ts`:
- Around line 6-8: The imports in this file are out of order: move the relative
import "import type { Session } from './data';" after the alias imports so they
follow the project's rule (external packages, path aliases (`@main`, `@renderer`,
`@shared`, `@preload`), then relative imports); ensure "import type { TriggerColor }
from '@shared/constants/triggerColors';" and "import { generateUUID } from
'@renderer/utils/uuid';" remain before the relative "./data" import, then run
the linter to verify ordering.
---
Nitpick comments:
In `@src/renderer/utils/uuid.ts`:
- Around line 12-25: Add a unit test that forces the fallback path in
generateUUID by temporarily removing or mocking crypto.randomUUID (set to
undefined) and then calling generateUUID(); assert the returned string matches
UUID v4 format (8-4-4-4-12 hex groups), verify the version nibble is 4
(character at position corresponding to bytes[6] -> UUID segment 3) and the
variant bits are 10xx (the high bits of the UUID segment 4), and restore/mock
back crypto.randomUUID after the test; target the generateUUID function in
src/renderer/utils/uuid.ts when writing this test.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a4a28f42-1e5f-4a0f-86b3-505f53734464
📒 Files selected for processing (6)
src/renderer/components/settings/NotificationTriggerSettings/utils/trigger.tssrc/renderer/components/settings/sections/WorkspaceSection.tsxsrc/renderer/store/slices/paneSlice.tssrc/renderer/store/slices/tabSlice.tssrc/renderer/types/tabs.tssrc/renderer/utils/uuid.ts
|
I'm going to assume this to happens to be purely a coincidence, but I have a PR for the same exact fix that I made an hour ago in #135 |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/renderer/types/tabs.ts`:
- Around line 6-8: Reorder the path-alias imports so `@renderer` imports come
before `@shared`: move the generateUUID import from '@renderer/utils/uuid' to
appear before the TriggerColor import from '@shared/constants/triggerColors'
(keeping the type import for Session from './data' after path aliases); ensure
import groups follow external packages, path aliases in the order `@main`,
`@renderer`, `@shared`, `@preload`, then relative imports to satisfy ESLint.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ef0085e8-eb3f-4e5a-a4bc-12bdf8d93b47
📒 Files selected for processing (1)
src/renderer/types/tabs.ts
crypto.randomUUID() is only available in secure contexts (HTTPS or localhost). When the Docker container is accessed over plain HTTP from another machine on the network, the browser does not expose crypto.randomUUID, causing a TypeError that breaks session clicks and other tab/pane interactions. Add a generateUUID() utility that uses crypto.randomUUID() when available and falls back to crypto.getRandomValues() (which works in all contexts). Replace all renderer call sites. Fixes matt1398#132
Move relative import after alias imports to satisfy the project's import ordering rules.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
matt1398
force-pushed
the
fix/crypto-random-uuid-non-secure-context
branch
from
4f27bfd to
2c0f351
Compare
|
Thanks for the fix! Another PR (#135) addresses the same issue and includes tests, so I'll be merging that one instead. Closing as duplicate — appreciate the contribution! |
3 participants
Summary
crypto.randomUUID()is only available in secure contexts (HTTPS orlocalhost/127.0.0.1). When the Docker container is accessed over plain HTTP from another machine (e.g.http://192.168.1.x:3456), the browser does not exposecrypto.randomUUID, throwingTypeError: crypto.randomUUID is not a functionon every tab/pane/session click.generateUUID()utility (src/renderer/utils/uuid.ts) that usescrypto.randomUUID()when available and falls back tocrypto.getRandomValues()(available in all modern browsers regardless of secure context).crypto.randomUUID()call sites in the renderer.Root Cause
The
openTabstore action (and other tab/pane actions) callcrypto.randomUUID()to generate IDs. This works when accessinghttp://localhost:3456(secure context) but throws when accessed viahttp://<lan-ip>:3456(not a secure context).The error from the browser console:
Test plan
http://localhost:3456— should work as beforehttp://<lan-ip>:3456from another machine — session clicks now workFixes #132
Summary by CodeRabbit