From b0d507a1e0d72c239702bb88a8331f6a6cfb0e31 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 16 Feb 2026 16:33:24 +0000
Subject: [PATCH] security: use CSPRNG for deduplication tag generation in
 buildViewEvent

Replaced Math.random() with a tiered approach using crypto.randomUUID()
and crypto.getRandomValues() to ensure cryptographically secure random
identifiers for deduplication tags in Nostr events.

This fix addresses a potential collision risk and follows security best
practices for random number generation in both browser and Node.js
environments.

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 js/nostrEventSchemas.js | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/js/nostrEventSchemas.js b/js/nostrEventSchemas.js
index fae71355..415ceb42 100644
--- a/js/nostrEventSchemas.js
+++ b/js/nostrEventSchemas.js
@@ -740,6 +740,24 @@ export function getAllNostrEventSchemas() {
   return entries;
 }
 
+function generateRandomIdentifier() {
+  if (
+    typeof globalThis.crypto !== "undefined" &&
+    typeof globalThis.crypto.randomUUID === "function"
+  ) {
+    return globalThis.crypto.randomUUID();
+  }
+  if (
+    typeof globalThis.crypto !== "undefined" &&
+    typeof globalThis.crypto.getRandomValues === "function"
+  ) {
+    const bytes = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+  return Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
+}
+
 function appendSchemaTags(tags, schema) {
   if (!Array.isArray(schema?.appendTags)) {
     return tags;
@@ -1834,9 +1852,7 @@ export function buildViewEvent(params) {
 
   const resolvedDedupeTag =
     dedupeTag ||
-    (schema?.identifierTag?.name
-      ? Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2)
-      : "");
+    (schema?.identifierTag?.name ? generateRandomIdentifier() : "");
 
   if (resolvedDedupeTag && schema?.identifierTag?.name) {
     const identifierName = schema.identifierTag.name;