[SECURITY] phpsec/random.php - CSPRNG isn't properly error checked

[AndrewCarterUK]

Note: I have been asked to log all the security issues that I have found by an OWASP contributor to support the decision to abandon this project. My personal opinion is that all of the code in this repository is beyond repair and that it is not wise to attempt to fix it.

openssl_random_psuedo_bytes can return FALSE and it can also set an optional second parameter to declare whether it managed to securely generate a random value or not.

The outputs should be checked and the function should fail hard if there has been an issue.

phpsec/libs/core/random.php

Line 52 in 1999edc

$random32bit=(int)(hexdec(bin2hex(openssl_random_pseudo_bytes(64))));

phpsec/libs/core/random.php

Line 114 in 1999edc

return substr(bin2hex(openssl_random_pseudo_bytes($length)), 0, $length);