FPV-662: fix(authorization): replace weak PRNG with CSPRNG for PKCE code_verifier generation

[Kesari3008]

COMPLETES #https://jira-eng-gpk2.cisco.com/jira/browse/FPV-662

This pull request addresses

Security fix: The _generateCodeChallenge method in authorization.js used lodash.random() (backed by Math.random / xorshift128+), a non-cryptographic PRNG, to generate the 128-character PKCE code_verifier. This violates RFC 7636 §7.1 and SEC-CRY-RANDOM-4 which require a cryptographically secure random source. Predictable code_verifier values expose the OAuth PKCE flow to offline brute-force attacks.

Root Cause: lodash.random() uses Math.random internally, which is a non-cryptographic PRNG.

by making the following changes

• Replaced the lodash.random() loop in _generateCodeChallenge with window.crypto.getRandomValues using a bias-free byte & 63 masking approach over the 64-character base64url alphabet
• Removed the lodash require from _generateCodeChallenge (no new dependencies needed; window.crypto is already accessible via this.webex.getWindow().crypto)
• Updated unit tests to assert window.crypto.getRandomValues is called, Math.random/lodash.random are never called, the verifier is 128 chars of base64url-safe characters, and the S256 challenge is the SHA-256/base64url hash of the verifier

Change Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Tooling change
• Internal code refactor

The following scenarios were tested

• Updated unit tests for _generateCodeChallenge covering:
  • window.crypto.getRandomValues is called (AC-6)
  • Math.random/lodash.random are never called
  • Verifier is 128 chars of base64url-safe characters (AC-2)
  • S256 challenge is SHA-256/base64url hash of the verifier (AC-3)
• Tests added: unit test suite updated (net +89 lines, -24 lines); all 66 unit tests pass
• Workflow verification: Gate 1 (compile) passed; Gate 2 (unit tests) passed; Gate 3 not run

Acceptance Criteria

ID	Criterion	Source	Recorded evidence
AC-1	CSPRNG used for code_verifier generation	Jira FPV-662	Addressed — window.crypto.getRandomValues used in _generateCodeChallenge replacing lodash.random()
AC-2	128-char base64url-safe verifier with no modulo bias	Jira FPV-662	Addressed — byte & 63 masking over 64-char alphabet eliminates modulo bias; length fixed at 128
AC-3	S256 challenge is SHA-256/base64url of verifier	Jira FPV-662	Addressed — existing SHA-256/base64url challenge computation unchanged; unit test verifies hash
AC-4	Verifier persisted and consumed from sessionStorage	Jira FPV-662	Addressed — existing sessionStorage persistence logic unchanged
AC-5	All existing unit tests pass	Jira FPV-662	Addressed — all 66 unit tests pass with Gate 2 green
AC-6	Test asserts getRandomValues called and Math.random not called	Jira FPV-662	Addressed — new unit tests assert getRandomValues called and Math.random/lodash.random never called

The GAI Coding Policy And Copyright Annotation Best Practices

• GAI was not used (or, no additional notation is required)
• Code was generated entirely by GAI
• GAI was used to create a draft that was subsequently customized or modified
• Coder created a draft manually that was non-substantively modified by GAI (e.g., refactoring was performed by GAI on manually written code)
• Tool used for AI assistance (GitHub Copilot / Other - specify)
  • Github Copilot
  • Other - Please Specify
• This PR is related to
  • Feature
  • Defect fix
  • Tech Debt
  • Automation

I certified that

• I have read and followed contributing guidelines
• I discussed changes with code owners prior to submitting this pull request
• I have not skipped any automated checks
• All existing and new tests passed
• I have updated the documentation accordingly

---

Make sure to have followed the contributing guidelines before submitting.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eac820f794

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Support the prefixed CSPRNG in IE 11

When this package runs in IE 11—which is explicitly included by the root Babel target ie >= 11—the Web Crypto implementation is exposed as window.msCrypto, not window.crypto; this dereference is therefore undefined and every initiateLogin() call aborts before navigation. Select the available crypto or msCrypto implementation so PKCE generation remains usable in this configured browser target.

Useful? React with 👍 / 👎.

[rarajes2]

LGTM. Please see if you can run the script/skill which caught this issue and it accepts this change.

[Kesari3008]

LGTM. Please see if you can run the script/skill which caught this issue and it accepts this change.

Checked with Kesava, there is a separate team who does this and we can rescan the PR fix