Zennoxa Shield
Rules / Java
SHIELD-JAVA-015

Insecure Randomness for Security Tokens

mediumJavaCWE-330CVSS 6.5

What it detects

Using java.util.Random or Math.random to generate tokens or secrets yields predictable values.

How to fix

Use java.security.SecureRandom for tokens, session IDs, and any security-sensitive values.

Vulnerable — Shield flags thisTokenService.java
import java.util.Random;

public class TokenService {
    public String passwordResetToken() {
        Random rnd = new Random();
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < 32; i++) {
            sb.append(Integer.toHexString(rnd.nextInt(16)));
        }
        return sb.toString();
    }
}
Fixed — scans cleanTokenService.java
import java.security.SecureRandom;
import java.util.HexFormat;

public class TokenService {
    private static final SecureRandom RNG = new SecureRandom();

    public String passwordResetToken() {
        byte[] buf = new byte[32];
        RNG.nextBytes(buf);
        return HexFormat.of().formatHex(buf);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-015, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-015: Insecure Randomness for Security Tokens — Zennoxa Shield