v0.31.2

src/proxy/upstream_helpers.rs

@@ -1,10 +1,11 @@
 fn request_id_hash(sequence: u64) -> String {
-    use rand::RngCore;
+    use rand::TryRng;
     use sha2::{Digest, Sha256};
 
     let mut nonce = [0u8; 32];
-    let mut rng = rand::rngs::OsRng;
-    rng.fill_bytes(&mut nonce);
+    let mut rng = rand::rngs::SysRng;
+    rng.try_fill_bytes(&mut nonce)
+        .expect("secure operating system random source unavailable");
     let mut hash = Sha256::new();
     hash.update(sequence.to_be_bytes());
     hash.update(nonce);
@@ -13,9 +14,18 @@ fn request_id_hash(sequence: u64) -> String {
 
 fn should_replace_error_page(response: &Response, minimal_welcome: bool) -> bool {
     !minimal_welcome
-        && response.extensions().get::<ErrorFallbackResponse>().is_none()
-        && response.extensions().get::<crate::pages::OriginProvidedResponse>().is_none()
-        && response.extensions().get::<crate::pages::PageServed>().is_none()
+        && response
+            .extensions()
+            .get::<ErrorFallbackResponse>()
+            .is_none()
+        && response
+            .extensions()
+            .get::<crate::pages::OriginProvidedResponse>()
+            .is_none()
+        && response
+            .extensions()
+            .get::<crate::pages::PageServed>()
+            .is_none()
         && response
             .extensions()
             .get::<crate::tinyauth::AuthenticationFailure>()
@@ -298,14 +308,19 @@ async fn observe(State(state): State<Arc<App>>, mut request: Request, next: Next
         let global_compression = &snapshot.envelope.config.compression;
         let mut compression = global_compression.clone();
         if let Some(frontend) = frontend_context.as_ref() {
-            compression = frontend.compression.resolve(global_compression, &compression);
+            compression = frontend
+                .compression
+                .resolve(global_compression, &compression);
         }
         if let Some(route) = effective_route_context {
             if let crate::config::CompiledSource::WebServer(service) = &route.source {
-                compression = service.compression.resolve(global_compression, &compression);
+                compression = service
+                    .compression
+                    .resolve(global_compression, &compression);
             }
         }
-        response = crate::compression::encode(response, &original_headers, &method, &compression).await;
+        response =
+            crate::compression::encode(response, &original_headers, &method, &compression).await;
         if let Some(encoding) = response
             .extensions()
             .get::<crate::compression::AppliedEncoding>()

src/proxy/websocket/handshake.rs

@@ -13,7 +13,7 @@ use http_body::{Body as HttpBody, Frame, SizeHint};
 use http_body_util::BodyExt;
 use hyper::upgrade::{OnUpgrade, Upgraded};
 use hyper_util::rt::TokioIo;
-use rand::{rngs::OsRng, RngCore};
+use rand::{rngs::SysRng, TryRng};
 use serde::Serialize;
 use sha1::{Digest, Sha1};
 use std::{
@@ -186,7 +186,7 @@ pub fn validate_h3(request: &Request) -> Result<Handshake> {
         "WebSocket version must be 13"
     );
     let mut nonce = [0u8; 16];
-    OsRng.fill_bytes(&mut nonce);
+    SysRng.try_fill_bytes(&mut nonce).expect("secure operating system random source unavailable");
     let key = STANDARD.encode(nonce);
     Ok(Handshake {
         accept: accept_for_key(&key),
@@ -229,7 +229,7 @@ pub fn validate_h2(request: &Request) -> Result<Handshake> {
         "WebSocket version must be 13"
     );
     let mut nonce = [0u8; 16];
-    OsRng.fill_bytes(&mut nonce);
+    SysRng.try_fill_bytes(&mut nonce).expect("secure operating system random source unavailable");
     let key = STANDARD.encode(nonce);
     Ok(Handshake {
         accept: accept_for_key(&key),