C039 - Fixing issues of Math.random()

[MV88]

Description

fixing some possible issues related to Math.Random in a dedicated branch C039-webmapper-28-10-2022

see here for more details https://kemilbeltre.medium.com/why-do-not-use-math-random-a6f8b0ad38dd
https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues

Please check if the PR fulfills these requirements

• The commit message follows our guidelines: https://github.com/geosolutions-it/MapStore2/blob/master/CONTRIBUTING.md
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

What kind of change does this PR introduce? (check one with "x", remove the others)

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Other... Please describe:

Issue

What is the current behavior?

#

What is the new behavior?

Breaking change

Does this PR introduce a breaking change? (check one with "x", remove the other)

• Yes, and I documented them in migration notes
• No

Other useful information

[offtherailz]

Sorry, but the usage here is not cryptographic, so using strong Math.random() looks lecit to me. Did I missed something? also the article you quote says:

You can use Math.random() when the expected value does not compromise the app.

and

Use strong generation methods as Crypto.getRandomValues() when required.

That I can understand as "not always"

[MV88]

Sorry, but the usage here is not cryptographic, so using strong Math.random() looks lecit to me. Did I missed something? also the article you quote says:

You can use Math.random() when the expected value does not compromise the app.

i would agree with you that if Math.random is used in non critical parts is fine to use, altough one of our client has in place a fortify scansion which spotted this as high issue. the thing is that they already marked them as reliable issues so i decided to solve them by using another method.

Now we could check maybe ignore them, or
we can add a rule in our eslint to avoid Math.random method or
we can fix it in another way

for the future we may decide for that client to mark these issues as not issues

Use strong generation methods as Crypto.getRandomValues() when required.

That I can understand as "not always"

idk what you mean here tbh