aws-samples / aws-samples/iot-lambda-sns-sqs-lambda-dynamodb
Random number as DynamoDB partition key — collision risk
Open
- Dominant language
- JavaScript
- Stars
- 2
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
Location:
allfilteredeventconsumer.js
ID: Math.floor(Math.random() * Math.floor(10000000)).toString(),
Using Math.random() with a range of 0-10,000,000 for the primary key. With sufficient volume, collisions will occur and silently overwrite previous records. This is a data loss bug, not just a security issue.
Fix: Use a UUID:
const { randomUUID } = require('crypto');
ID: randomUUID(),
Contributor guide
Assessment
This issue has not been assessed yet.