Workdir IDs use Math.random() — predictable

[mrjf]

Summary

randomId() uses Math.random() to generate workdir names. The output is 8 chars of base36, derived from a non-cryptographic PRNG.

Where

packages/runtime/src/band-server.ts:139-141

function randomId(): string {
  return Math.random().toString(36).slice(2, 10);
}

Impact

Workdir paths are predictable to anyone running on the VM. A local attacker (another process inside the VM, if one ever exists) could pre-create a malicious symlink at the predicted path so the server writes secrets into a file the attacker controls.

Low severity in the current threat model — band-runner is the only unprivileged user inside the VM. But trivial to fix.

Fix

import { randomBytes } from "crypto";
function randomId(): string {
  return randomBytes(8).toString("hex");
}