falconGitHub

prefer-random-secure

Path
lint/security/prefer-random-secure
Default
Off, opt in
Origin
Falcon
Rule
395 of 512

Prefer the cryptographically secure dart:math random generator.

Only resolved unnamed Random constructors are checked; explicit seeds are exempt because they express a requirement for reproducible randomness.

Invalid

example.dartdart
import 'dart:math';
import 'dart:math' as math;
final first = Random();
final second = new Random();
final third = math.Random();
final fourth = new math.Random();
Random create() => Random();
final explicitNew = Random.new();
Use `Random.secure()` when reproducible randomness is not required.
2import 'dart:math' as math;
3final first = Random();
Use `Random.secure()` when reproducible randomness is not required.
3final first = Random();
4final second = new Random();
Use `Random.secure()` when reproducible randomness is not required.
4final second = new Random();
5final third = math.Random();
Use `Random.secure()` when reproducible randomness is not required.
5final third = math.Random();
6final fourth = new math.Random();
Use `Random.secure()` when reproducible randomness is not required.
6final fourth = new math.Random();
7Random create() => Random();
Use `Random.secure()` when reproducible randomness is not required.
7Random create() => Random();
8final explicitNew = Random.new();

Valid

example.dartdart
import 'dart:math';
import 'dart:math' as math;
final secure = Random.secure();
final prefixedSecure = math.Random.secure();
final seeded = Random(42);
final explicitSeeded = new Random(7);
final prefixedSeeded = math.Random(1);
void shadow(dynamic Random) { Random(); }
class Other { Other(); }
final other = Other();

Configure prefer-random-secure

Set its severity in falcon.json. See the configuration guide.

falcon.jsonjson
{
  "linter": {
    "rules": {
      "security": {
        "prefer-random-secure": "error"
      }
    }
  }
}

Or silence one occurrence with a suppression comment; the reason is required.

example.dartdart
// falcon-ignore lint/security/prefer-random-secure: <reason>