[security] Use crypto.randomBytes() to generate the masking key (#994)

websockets · Feb 8, 2017 · 1653db1 · 1653db1
1 parent c7bb730
commit 1653db1
Showing 1 changed file with 2 additions and 6 deletions.
diff --git a/lib/Sender.js b/lib/Sender.js
@@ -6,6 +6,7 @@
 
 var events = require('events')
   , util = require('util')
+  , crypto = require('crypto')
   , EventEmitter = events.EventEmitter
   , ErrorCodes = require('./ErrorCodes')
   , bufferUtil = require('./BufferUtil').BufferUtil
@@ -315,10 +316,5 @@ function getArrayBuffer(data) {
 }
 
 function getRandomMask() {
-  return new Buffer([
-    ~~(Math.random() * 255),
-    ~~(Math.random() * 255),
-    ~~(Math.random() * 255),
-    ~~(Math.random() * 255)
-  ]);
+  return crypto.randomBytes(4);
 }