Skip to content

Commit

Permalink
fix: replace uses of obsolete method RNGCryptoServiceProvider (#766)
Browse files Browse the repository at this point in the history
Replace insecure obsolete method (new RNGCryptoServiceProvider()) with RandomNumberGenerator.Create() in PkzipClassic, ZipFile and ZipOutputStream.

See docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.rngcryptoserviceprovider?view=net-6.0 and dotnet/runtime#40169
  • Loading branch information
yihezkel authored Aug 16, 2022
1 parent 7411f3a commit 79614c5
Show file tree
Hide file tree
Showing 3 changed files with 7 additions and 7 deletions.
4 changes: 2 additions & 2 deletions src/ICSharpCode.SharpZipLib/Encryption/PkzipClassic.cs
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ namespace ICSharpCode.SharpZipLib.Encryption
{
/// <summary>
/// PkzipClassic embodies the classic or original encryption facilities used in Pkzip archives.
/// While it has been superceded by more recent and more powerful algorithms, its still in use and
/// While it has been superseded by more recent and more powerful algorithms, its still in use and
/// is viable for preventing casual snooping
/// </summary>
public abstract class PkzipClassic : SymmetricAlgorithm
Expand Down Expand Up @@ -444,7 +444,7 @@ public override byte[] Key
public override void GenerateKey()
{
key_ = new byte[12];
using (var rng = new RNGCryptoServiceProvider())
using (var rng = RandomNumberGenerator.Create())
{
rng.GetBytes(key_);
}
Expand Down
2 changes: 1 addition & 1 deletion src/ICSharpCode.SharpZipLib/Zip/ZipFile.cs
Original file line number Diff line number Diff line change
Expand Up @@ -3781,7 +3781,7 @@ private static void CheckClassicPassword(CryptoStream classicCryptoStream, ZipEn
private static void WriteEncryptionHeader(Stream stream, long crcValue)
{
byte[] cryptBuffer = new byte[ZipConstants.CryptoHeaderSize];
using (var rng = new RNGCryptoServiceProvider())
using (var rng = RandomNumberGenerator.Create())
{
rng.GetBytes(cryptBuffer);
}
Expand Down
8 changes: 4 additions & 4 deletions src/ICSharpCode.SharpZipLib/Zip/ZipOutputStream.cs
Original file line number Diff line number Diff line change
Expand Up @@ -723,7 +723,7 @@ private byte[] CreateZipCryptoHeader(long crcValue)
InitializeZipCryptoPassword(Password);

byte[] cryptBuffer = new byte[ZipConstants.CryptoHeaderSize];
using (var rng = new RNGCryptoServiceProvider())
using (var rng = RandomNumberGenerator.Create())
{
rng.GetBytes(cryptBuffer);
}
Expand Down Expand Up @@ -808,11 +808,11 @@ public override void Write(byte[] buffer, int offset, int count)

private void CopyAndEncrypt(byte[] buffer, int offset, int count)
{
const int CopyBufferSize = 4096;
byte[] localBuffer = new byte[CopyBufferSize];
const int copyBufferSize = 4096;
byte[] localBuffer = new byte[copyBufferSize];
while (count > 0)
{
int bufferCount = (count < CopyBufferSize) ? count : CopyBufferSize;
int bufferCount = (count < copyBufferSize) ? count : copyBufferSize;

Array.Copy(buffer, offset, localBuffer, 0, bufferCount);
EncryptBlock(localBuffer, 0, bufferCount);
Expand Down

0 comments on commit 79614c5

Please sign in to comment.