From ff81f08c18815a0592be7ce8074b0ad4f8c5686b Mon Sep 17 00:00:00 2001
From: kanywst <niwatakuma@icloud.com>
Date: Sun, 19 Jul 2026 13:40:39 +0900
Subject: [PATCH] server: use OsRng for refresh and password-reset tokens

gen_random_string generated the refresh and password-reset tokens with
SmallRng, which is not a CSPRNG, while the rest of the codebase uses OsRng
for secrets. Switch it to OsRng to match.
---
 server/src/sql_tcp_backend_handler.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/src/sql_tcp_backend_handler.rs b/server/src/sql_tcp_backend_handler.rs
index 834290d..3b43ec0 100644
--- a/server/src/sql_tcp_backend_handler.rs
+++ b/server/src/sql_tcp_backend_handler.rs
@@ -15,8 +15,8 @@ use std::collections::HashSet;
 use tracing::{debug, instrument};
 
 fn gen_random_string(len: usize) -> String {
-    use rand::{Rng, SeedableRng, distributions::Alphanumeric, rngs::SmallRng};
-    let mut rng = SmallRng::from_entropy();
+    use rand::{Rng, distributions::Alphanumeric, rngs::OsRng};
+    let mut rng = OsRng;
     std::iter::repeat(())
         .map(|()| rng.sample(Alphanumeric))
         .map(char::from)