Documented: math/rand → crypto/rand mask key fix (CWE-338, never CVE'd)

[canolgun]

Not a zero-day — already fixed in v1.5.3. Documenting a silent security fix from commit d67f418.\n\n- Finding: WebSocket mask keys generated with math/rand instead of crypto/rand (CWE-338)\n- Fix: v1.5.3 (2024-06-14)\n- Advisory: https://github.com/canolgun-commits/websocket/security/advisories/GHSA-w67g-5rqw-f597\n- Tool: bounty-hunter v6.0

[abscondment]

@canolgun this does not appear to be accurate.

https://github.com/gorilla/websocket/commits/v1.5.3 does not contain the code from d67f418

See, for example, the continued use of math/rand: https://github.com/gorilla/websocket/blob/v1.5.3/conn.go#L13

v1.5.3 was tagged/published on 2024-06-14, 2+ weeks before that commit was made.

Am I missing something?