From 601f681787c8d6c02bb3566b8cefde289377be0e Mon Sep 17 00:00:00 2001 From: Eli Young Date: Thu, 28 May 2015 18:15:05 -0700 Subject: fqdn_rotate: Don't use the value itself as part of the random seed Previously, the random number generator was seeded with the array or string to be rotated in addition to any values specifically provided for seeding. This behavior is potentially insecure in that it allows an attacker who can modify the source data to choose the post-shuffle order. --- spec/acceptance/fqdn_rotate_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'spec/acceptance') diff --git a/spec/acceptance/fqdn_rotate_spec.rb b/spec/acceptance/fqdn_rotate_spec.rb index 753068b..366d027 100755 --- a/spec/acceptance/fqdn_rotate_spec.rb +++ b/spec/acceptance/fqdn_rotate_spec.rb @@ -36,7 +36,7 @@ describe 'fqdn_rotate function', :unless => UNSUPPORTED_PLATFORMS.include?(fact( EOS apply_manifest(pp, :catch_failures => true) do |r| - expect(r.stdout).to match(/fqdn_rotate is \["c", "d", "a", "b"\]/) + expect(r.stdout).to match(/fqdn_rotate is \["d", "a", "b", "c"\]/) end end end -- cgit v1.2.3