From 712cc7e96b5f5b8d21da2a3506fd65a9745be30b Mon Sep 17 00:00:00 2001
From: gonzaloriestra <14979109+gonzaloriestra@users.noreply.github.com>
Date: Sun, 12 Jul 2026 00:12:39 +0000
Subject: [PATCH] [Security] harden client ID generation

Replace Math.random() with a more secure ID generation method in ExtensionServerClient.

Introduced a generateRandomId utility that uses globalThis.crypto.randomUUID() where available.
---
 .../ExtensionServerClient/ExtensionServerClient.ts    |  4 ++--
 .../ui-extensions-server-kit/src/utilities/index.ts   |  1 +
 .../src/utilities/randomId.ts                         | 11 +++++++++++
 3 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 packages/ui-extensions-server-kit/src/utilities/randomId.ts

diff --git a/packages/ui-extensions-server-kit/src/ExtensionServerClient/ExtensionServerClient.ts b/packages/ui-extensions-server-kit/src/ExtensionServerClient/ExtensionServerClient.ts
index 507bfb5df73..f3d2eab56f2 100644
--- a/packages/ui-extensions-server-kit/src/ExtensionServerClient/ExtensionServerClient.ts
+++ b/packages/ui-extensions-server-kit/src/ExtensionServerClient/ExtensionServerClient.ts
@@ -8,7 +8,7 @@ import {
   getFlattenedLocalization,
   isFlattenedTranslations,
 } from '../i18n'
-import {isUIExtension, isValidSurface} from '../utilities'
+import {isUIExtension, isValidSurface, generateRandomId} from '../utilities'
 import {DeepPartial, ExtensionPayload, ExtensionPoint} from '../types'
 
 export class ExtensionServerClient implements ExtensionServer.Client {
@@ -32,7 +32,7 @@ export class ExtensionServerClient implements ExtensionServer.Client {
   private uiExtensionsByUuid: Record<string, ExtensionServer.UIExtension> = {}
 
   constructor(options: DeepPartial<ExtensionServer.Options> = {}) {
-    this.id = (Math.random() + 1).toString(36).substring(7)
+    this.id = generateRandomId()
     this.options = getValidatedOptions({
       ...options,
       connection: {
diff --git a/packages/ui-extensions-server-kit/src/utilities/index.ts b/packages/ui-extensions-server-kit/src/utilities/index.ts
index f53050a3aa8..740d379f1e8 100644
--- a/packages/ui-extensions-server-kit/src/utilities/index.ts
+++ b/packages/ui-extensions-server-kit/src/utilities/index.ts
@@ -4,3 +4,4 @@ export * from './set'
 export * from './assetToString'
 export * from './isValidSurface'
 export * from './isUIExtension'
+export * from './randomId'
diff --git a/packages/ui-extensions-server-kit/src/utilities/randomId.ts b/packages/ui-extensions-server-kit/src/utilities/randomId.ts
new file mode 100644
index 00000000000..ed4dbf117b3
--- /dev/null
+++ b/packages/ui-extensions-server-kit/src/utilities/randomId.ts
@@ -0,0 +1,11 @@
+/**
+ * Generates a random ID.
+ *
+ * @returns A random ID.
+ */
+export function generateRandomId(): string {
+  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
+    return crypto.randomUUID()
+  }
+  return (Math.random() + 1).toString(36).substring(7)
+}