This repository was archived by the owner on Nov 15, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Remove impl Randomness for () #6452
Copy link
Copy link
Closed
Labels
I2-securityThe client fails to follow expected, security-sensitive, behaviour.The client fails to follow expected, security-sensitive, behaviour.
Description
We gained an impl<Output: Decode + Default> Randomness<Output> for () in https://crates.parity.io/frame_support/traits/trait.Randomness.html#foreign-impls added by cdceee2#diff-0010d009b169768f89902f63e50e3c10R780 which looks dangerous.
It's only used in frame/society/src/mock.rs which lives behind #[cfg(test)] mod mock; so maybe it can be replaced by pallet-randomness-collective-flip which provides insecure randomness for tests elsewhere?
If we want this, then it would require the test feature be propagated into frame-support, like
impl<Output: Decode + Default> Randomness<Output> for () {
fn random(subject: &[u8]) -> Output {
if cfg!(test) {
Output::decode(&mut TrailingZeroInput::new(subject)).unwrap_or_default()
} else {
panic!("Used () as Randomness in production")
}
}
}
If test already implies std then one might play games with std::collections::hash_map::RandomState but presumably that's more cargo pain than its worth.
rphmeier
Metadata
Metadata
Assignees
Labels
I2-securityThe client fails to follow expected, security-sensitive, behaviour.The client fails to follow expected, security-sensitive, behaviour.