Merge pull request #16945 from ckeditor/ck/remove-math-random-from-uid

Internal (utils): Remove `Math.random()` from `uid` implementation.

packages/ckeditor5-utils/src/uid.ts

@@ -26,19 +26,7 @@ const HEX_NUMBERS = new Array( 256 ).fill( '' )
  */
 export default function uid(): string {
 	// Let's create some positive random 32bit integers first.
-	//
-	// 1. Math.random() is a float between 0 and 1.
-	// 2. 0x100000000 is 2^32 = 4294967296.
-	// 3. >>> 0 enforces integer (in JS all numbers are floating point).
-	//
-	// For instance:
-	//		Math.random() * 0x100000000 = 3366450031.853859
-	// but
-	//		Math.random() * 0x100000000 >>> 0 = 3366450031.
-	const r1 = Math.random() * 0x100000000 >>> 0;
-	const r2 = Math.random() * 0x100000000 >>> 0;
-	const r3 = Math.random() * 0x100000000 >>> 0;
-	const r4 = Math.random() * 0x100000000 >>> 0;
+	const [ r1, r2, r3, r4 ] = crypto.getRandomValues( new Uint32Array( 4 ) );
 
 	// Make sure that id does not start with number.
 	return 'e' +

packages/ckeditor5-utils/tests/uid.js

@@ -7,6 +7,10 @@ import uid from '../src/uid.js';
 
 describe( 'utils', () => {
 	describe( 'uid', () => {
+		afterEach( () => {
+			sinon.restore();
+		} );
+
 		it( 'should return different ids', () => {
 			const id1 = uid();
 			const id2 = uid();
@@ -22,5 +26,13 @@ describe( 'utils', () => {
 			expect( id2 ).to.match( uuidRegex );
 			expect( id3 ).to.match( uuidRegex );
 		} );
+
+		it( 'should not use Math.random()', () => {
+			const spy = sinon.spy( Math, 'random' );
+
+			uid();
+
+			expect( spy.notCalled ).to.be.true;
+		} );
 	} );
 } );