[SPARK-42922] Use SecureRandom, instead of Random in security sensitive contexts

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.2.3, 3.3.2, 3.4.0, 3.5.0
• Fix Version/s: 3.3.3, 3.4.1, 3.5.0
• Component/s: SQL
• Assignee: Mridul Muralidharan
• Reporter: Mridul Muralidharan
• Created: 25/Mar/23 16:15
• Updated: 28/Mar/23 03:49
• Resolved: 28/Mar/23 03:49

Description

Most uses of Random in spark are either in test cases or where we need a pseudo random number which is repeatable.
The following are usages where moving from Random to SecureRandom would be useful

a) HttpAuthUtils.createCookieToken
b) ThriftHttpServlet.RAN