biblibre/hea-ws

Hea Web Service

hea-ws's Issues

Poorly random library-id

@PaulPoulain hi !

I started to look at the code of hea, and for my limited understanding of it, it seems that library-id could be enumerated too easily.

When a library post data for the first time, it don't provide library-id, and hea-ws generate a new one, returned to the library.

But the algorithm used for the library-id is poorly randomized: it is the hash of:

• the library-name : provided by the library, by default empty, and if customized it could be more or less easily guested
• and a random number between 0 and 9999, that could be rapidly enumerated (only 10000 possibilities).

A better random id should be generated, for example using a third-party library like
Data::Entropy, Crypt::Random, Math::Random::Secure, or Math::TrulyRandom. The size of the random part should be big enought to discard any enumeration possibility (128 bit of entropy for example). The size of the id it-self will be the same as it is hashed.

The problem with enumeration is that it could compromise the quality of data on hea: any person that can guest the library-id could delete and replace the values of a library. Please note, that it don't protect against new "bad" data.