Improved nonce safety

psyker156 · psyker156 · commit 153e248dc99c · 2025-01-04T16:57:51.000-05:00
generate_nonce() was rewritten to promote the use of a crypto safe PRNG
diff --git a/woocommerce/oauth.py b/woocommerce/oauth.py
@@ -10,10 +10,10 @@
 __license__ = "MIT"
 
 from time import time
-from random import randint
+from os import urandom
 from hmac import new as HMAC
-from hashlib import sha1, sha256
-from base64 import b64encode
+from hashlib import sha256
+from base64 import b64encode, urlsafe_b64encode
 from collections import OrderedDict
 from urllib.parse import urlencode, quote, unquote, parse_qsl, urlparse
 
@@ -122,10 +122,5 @@ def get_value_like_as_php(val):
 
     @staticmethod
     def generate_nonce():
-        """ Generate nonce number """
-        nonce = ''.join([str(randint(0, 9)) for i in range(8)])
-        return HMAC(
-            nonce.encode(),
-            "secret".encode(),
-            sha1
-        ).hexdigest()
+        """Generate a crypto safe random 32-byte string and encode it in Base64"""
+        return urlsafe_b64encode(urandom(32)).decode('utf-8').rstrip('=')
