18 lines
459 B
PHP
18 lines
459 B
PHP
|
<?php
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Architecture tests to prevent use of insecure PRNGs in application code.
|
||
|
|
*
|
||
|
|
* mt_rand() and rand() are not cryptographically secure. Use random_int()
|
||
|
|
* or random_bytes() instead for any security-sensitive context.
|
||
|
|
*
|
||
|
|
* @see GHSA-33rh-4c9r-74pf
|
||
|
|
*/
|
||
|
|
arch('app code must not use mt_rand')
|
||
|
|
->expect('App')
|
||
|
|
->not->toUse(['mt_rand', 'mt_srand']);
|
||
|
|
|
||
|
|
arch('app code must not use rand')
|
||
|
|
->expect('App')
|
||
|
|
->not->toUse(['rand', 'srand']);
|