Appknox Autofix: fix 1 file(s)

[ssingh55]

Appknox Autofix

Three weak PRNG vulnerabilities were detected in your Android application: one in OkHttpClient's WebSocket implementation using the Random class, and two in MainActivity click handlers using Math.random(). Replace all weak PRNG calls with SecureRandom to ensure cryptographically secure randomness in security-sensitive operations.

• Replace Random class in OkHttpClient WebSocket initialization: OkHttpClient's newWebSocket() method is internally using java.util.Random for connection or protocol operations. You cannot directly modify OkHttpClient library code, but you must audit your application code that calls newWebSocket(). If your code creates or configures the OkHttpClient instance, replace any explicit Random() instantiations in the same module with SecureRandom. If OkHttpClient itself is the source, upgrade to the latest OkHttp version (4.9.0+) which uses SecureRandom internally. Verify your app's target SDK is 23+.
• Replace Math.random() in MainActivity$3 onClick handler: In the onClick(View) method of the MainActivity$3 inner class, remove all calls to Math.random(). Replace with SecureRandom.nextDouble() or an equivalent SecureRandom method that generates the required value type. Math.random() produces doubles in [0.0, 1.0); use SecureRandom().nextDouble() for the same range, or nextBytes() + encoding for integer or token values.
• Replace Math.random() in MainActivity$4 onClick handler: In the onClick(View) method of the MainActivity$4 inner class, remove all calls to Math.random(). Replace with SecureRandom.nextDouble() or an equivalent SecureRandom method that generates the required value type.
• Import and initialize SecureRandom: Add the import statement for java.security.SecureRandom at the top of MainActivity.java (or your custom handler class). Initialize a SecureRandom instance once (as a static field or within the method) and reuse it for all random value generation in security-sensitive code paths.
• Add static analysis rule to prevent regression: Add a detekt or lint rule in your Android project that flags any import or use of java.util.Random or Math.random() in security-sensitive modules. This ensures new code cannot reintroduce the vulnerability. Create or update a custom lint rule file or detekt configuration to block these APIs.

Scan finding

• Appknox file (build): 118
• Appknox analysis (finding): 11829
• Fix scope: pr_changes
• Triggered by: [TEST] autofix scope: touches MainActivity.java #15

Acceptance criteria

• Verify OkHttpClient is version 4.9.0 or later by checking build.gradle dependencies.
• Inspect MainActivity.java to confirm SecureRandom import is present and all instances of Math.random() are removed from MainActivity$3 and MainActivity$4 onClick methods.
• Search the codebase for 'Math.random' and 'new Random()' to confirm no remaining weak PRNG calls in security-sensitive code paths.
• Run a lint/detekt analysis to confirm no new violations of weak PRNG APIs are detected.
• Test each onClick handler and WebSocket flow at runtime to verify application behavior is unchanged and no exceptions are thrown.
• Review any tokens, session IDs, or nonces generated by the old Random implementation and rotate them in your backend system, assuming their values were reconstructible.

References

• https://developer.android.com/reference/java/security/SecureRandom
• https://cheatsheetseries.owasp.org/cheatsheets/Android_Cheat_Sheet.html#use-cryptographic-prng
• https://cwe.mitre.org/data/definitions/338.html
• https://square.github.io/okhttp/changelog/#version-490

Generated by Appknox Autofix — review before merging.