From 887fe3a3a85e28f007f3a1861b3cc54d70867488 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 21 Oct 2026 17:14:27 -0400
Subject: [PATCH] security: use crypto.randomUUID for temp file suffix
 (SonarCloud S2245)

Replace Math.random() with crypto.randomUUID() when generating the unique
suffix for the atomic write-then-move temp file. The value isn't security-
sensitive, but a CSPRNG gives a stronger uniqueness guarantee and resolves
SonarCloud javascript:S2245.
---
 apps/effectcraft-web/js/host.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/effectcraft-web/js/host.js b/apps/effectcraft-web/js/host.js
index 5c438550..658a5199 100644
--- a/apps/effectcraft-web/js/host.js
+++ b/apps/effectcraft-web/js/host.js
@@ -495,7 +495,7 @@ export async function cacheRead(name) {
 export async function cacheWrite(fullName, bytes) {
   const [dir, name] = await entryDir(fullName);
   const canMove = typeof FileSystemHandle !== "undefined" && "move" in FileSystemHandle.prototype;
-  const tmp = canMove ? `${name}.tmp.${Math.random().toString(36).slice(2)}` : name;
+  const tmp = canMove ? `${name}.tmp.${crypto.randomUUID()}` : name;
   const fh = await dir.getFileHandle(tmp, { create: true });
   if (fh.createSyncAccessHandle) {
     const h = await fh.createSyncAccessHandle();