用随机数严重的错误 [英] serious bug with random numbers
问题描述
我终于可以创建一个方式重现，我有错误。当2个或更多的用户在同一第二ModSecurity的调用页生成（使用兰特（）从PHP函数）的随机数相同的序列两个用户
下面是错误示范：
http://quemfazsite.com.br/em_criacao/modelo9/teste.php
打开此页，2内部框架将加载和每一个应该是产生随机数彼此independetly但两者帧被产生随机数的相同序列！很简单的源$ C $ C可以看到下面。如果你不看到相同的序列我请你重新加载页面几次，直到你得到相同的数字序列。
编辑：这个bug只有ModSecurity的积极反应。如果你评论说，加载ModSecurity的错误不会发生了的LoadModule行！
＆LT; PHP如果（使用isset（$ _ GET [测试））{ $输出=; 为（$ I = 0; $ I小于10; $ I ++）{ $输出=兰特（0,99999999）。 ＆LT; BR /＆gt;中; } 回声$输出; 出口（）;}？＆GT;
＆LT; IFRAME SRC =？PUT_THE_SAME_NAME_OF_THIS_FILE_HERE.php测试＆放大器; 953487＆GT;＆LT; / IFRAME＆GT;
＆LT; IFRAME SRC =？PUT_THE_SAME_NAME_OF_THIS_FILE_HERE.php测试＆放大器; 234322＆GT;＆LT; / IFRAME＆GT;
兰特不是用来产生随机数。其目的是产生 被给定之间均匀分布的伪随机数 端点。如果你把你生成的数字的柱状图，你会看到，他们确实是均匀分布的。
这是产生这些数字的算法是完全确定的。如果您提供了相同的种子（通常是基于当前的时间，因为在你的例子），你会得到完全相同的数字序列。这是一个特性，而不是bug：它可以让你利用分布的统计特性，同时能够通过重用种子繁殖后的结果。
如果你需要的随机数是联合国predictable，您应该使用加密RNG
如果你只是想避免有力这样的冲突（由于碰撞时衍生的种子），那么你就必须要检查一些跨会话存储，以确保唯一性（例如文件或数据库）。如果你的应用程序需要的数字始终是唯一的，那么你应该这样做呢。
I finally could create a way to reproduce the bug that I am having. When 2 or more users call a page at the same second modsecurity generates the same sequence of random numbers (using rand() function from php) to both users.
Here is a demonstration of the bug:
http://quemfazsite.com.br/em_criacao/modelo9/teste.php
Opening this page, 2 iframes will load and each one should be generating random numbers independetly of each other but both frames are generating the same sequence of random numbers! The very simple source code can be seen below. If you dont see the same sequence I ask you to reload the page a few times till you get the same number sequence.
EDIT: this bug only happens with modsecurity active. If you comment the "LoadModule" line that loads the modsecurity the bug wont happen!
<?php
if (isset($_GET["test"])) {
$output= "";
for ($i=0;$i<10;$i++) {
$output.= rand(0,99999999) . "<br />";
}
echo $output;
exit();
}
?>
<iframe src="PUT_THE_SAME_NAME_OF_THIS_FILE_HERE.php?test&953487"></iframe>
<iframe src="PUT_THE_SAME_NAME_OF_THIS_FILE_HERE.php?test&234322"></iframe>
rand is not designed to produce random numbers. Its purpose is to produce pseudorandom numbers that are distributed uniformly between the given endpoints. If you make a histogram of the numbers you've generated, you'll see that they are indeed uniformly distributed.
The algorithm that generates these numbers is entirely deterministic. If you provide the same seed (usually based on the current time, as in your example) you'll get exactly the same sequence of numbers. This is a feature, not a bug: it allows you exploit the statistical properties of the distribution while being able to reproduce the results afterwards by reusing the seed.
If you need the random numbers to be unpredictable, you should be using a cryptographic RNG.
If you just want to robustly avoid clashes like this (caused by colliding time-derived seeds), then you'll have to check against some sort of cross-session storage to ensure uniqueness (e.g. a file or database). If your application requires that the numbers are always unique, then you should be doing this anyway.
这篇关于用随机数严重的错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
