The random module uses a Mersenne Twister PRNG — NOT suitable for cryptography. random.random, random.choice, random.randint, and SystemRandom(..) should be flagged for security contexts. Use the secrets module for tokens, passwords, and keys.
.random().randint().choice().randbytes().seed().random()Sinkrandom.random() -> float
Non-crypto float in [0.0, 1.0). Sink for security-relevant randomness.
.randint()Sinkrandom.randint(a: int, b: int) -> int
Non-crypto integer in [a, b]. Sink for security-relevant randomness.
.choice()Sinkrandom.choice(seq)
Non-crypto random choice. Sink for tokens / passwords / keys.
.randbytes()Sinkrandom.randbytes(n: int) -> bytes
Non-crypto random bytes. Sink for cryptographic use.
.seed()Sinkrandom.seed(a=None, version=2) -> None
Seeds the PRNG. Findings when seeded with predictable value for security-sensitive randomness.
| FQN | Field | |
|---|---|---|
| random | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyRandom