From 8f71d275526b9c8edbcff9dd68164abf27a7c4b9 Mon Sep 17 00:00:00 2001
From: Christoph Tavan <dev@tavan.de>
Date: Mon, 20 Jan 2020 23:06:11 +0100
Subject: [PATCH] feat: remove insecure fallback random number generator

BREAKING CHANGE: Remove builtin support for insecure random number
generators in the browser. Users who want that will have to supply their
own random number generator function.

Fixes #173.
---
 src/rng-browser.js      | 35 ++++++++---------------------------
 src/rng.js              |  2 +-
 test/browser/ie.test.js |  6 ++++++
 test/unit/unit.test.js  | 17 +++++------------
 4 files changed, 20 insertions(+), 40 deletions(-)

diff --git a/src/rng-browser.js b/src/rng-browser.js
index 1a96ee5f..93860233 100644
--- a/src/rng-browser.js
+++ b/src/rng-browser.js
@@ -11,31 +11,12 @@ var getRandomValues =
     typeof window.msCrypto.getRandomValues == 'function' &&
     msCrypto.getRandomValues.bind(msCrypto));
 
-let rng;
-
-if (getRandomValues) {
-  // WHATWG crypto RNG - http://wiki.whatwg.org/wiki/Crypto
-  var rnds8 = new Uint8Array(16); // eslint-disable-line no-undef
-
-  rng = function whatwgRNG() {
-    getRandomValues(rnds8);
-    return rnds8;
-  };
-} else {
-  // Math.random()-based (RNG)
-  //
-  // If all else fails, use Math.random().  It's fast, but is of unspecified
-  // quality.
-  var rnds = new Array(16);
-
-  rng = function mathRNG() {
-    for (var i = 0, r; i < 16; i++) {
-      if ((i & 0x03) === 0) r = Math.random() * 0x100000000;
-      rnds[i] = (r >>> ((i & 0x03) << 3)) & 0xff;
-    }
-
-    return rnds;
-  };
+var rnds8 = new Uint8Array(16); // eslint-disable-line no-undef
+export default function rng() {
+  if (!getRandomValues) {
+    throw new Error(
+      'uuid: This browser does not seem to support crypto.getRandomValues(). If you need to support this browser, please provide a custom random number generator through options.rng',
+    );
+  }
+  return getRandomValues(rnds8);
 }
-
-export default rng;
diff --git a/src/rng.js b/src/rng.js
index de783100..33513bb8 100644
--- a/src/rng.js
+++ b/src/rng.js
@@ -1,5 +1,5 @@
 import crypto from 'crypto';
 
-export default function nodeRNG() {
+export default function rng() {
   return crypto.randomBytes(16);
 }
diff --git a/test/browser/ie.test.js b/test/browser/ie.test.js
index aba68721..40c19434 100644
--- a/test/browser/ie.test.js
+++ b/test/browser/ie.test.js
@@ -14,4 +14,10 @@ browserTest('ie', 9003, [
     os: 'Windows',
     os_version: '7',
   },
+  {
+    browserName: 'IE',
+    browser_version: '8.0',
+    os: 'Windows',
+    os_version: '7',
+  },
 ]);
diff --git a/test/unit/unit.test.js b/test/unit/unit.test.js
index c5b0d648..26f5d4c2 100644
--- a/test/unit/unit.test.js
+++ b/test/unit/unit.test.js
@@ -10,9 +10,7 @@ import v3 from '../../src/v3.js';
 import v5 from '../../src/v5.js';
 
 describe('rng', () => {
-  test('nodeRNG', () => {
-    assert.equal(rng.name, 'nodeRNG');
-
+  test('Node.js RNG', () => {
     var bytes = rng();
     assert.equal(bytes.length, 16);
 
@@ -21,15 +19,10 @@ describe('rng', () => {
     }
   });
 
-  test('mathRNG', () => {
-    assert.equal(rngBrowser.name, 'mathRNG');
-
-    var bytes = rng();
-    assert.equal(bytes.length, 16);
-
-    for (var i = 0; i < bytes.length; i++) {
-      assert.equal(typeof bytes[i], 'number');
-    }
+  test('Browser without crypto.getRandomValues()', () => {
+    assert.throws(() => {
+      rngBrowser();
+    });
   });
 
   // Test of whatwgRNG missing for now since with esmodules we can no longer manipulate the