From 2711fe74d8dfc4be1e0b93e23032f5019afa24ec Mon Sep 17 00:00:00 2001
From: CaptainB <bin@fit2cloud.com>
Date: Mon, 28 Sep 2026 09:45:07 +0800
Subject: [PATCH] chore: replace random module with secrets for secure random
 number generation

---
 apps/common/init/init_template.py | 14 +++++++++++++-
 apps/users/serializers/user.py    |  5 ++---
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/apps/common/init/init_template.py b/apps/common/init/init_template.py
index f77a86ec2a8..3f6c6e56773 100644
--- a/apps/common/init/init_template.py
+++ b/apps/common/init/init_template.py
@@ -6,12 +6,22 @@
     @date：2025/12/1 17:16
     @desc:
 """
+import secrets
 from typing import Any
 
+from jinja2 import pass_context
 from jinja2.sandbox import SandboxedEnvironment
 from langchain_core.prompts.string import DEFAULT_FORMATTER_MAPPING, _HAS_JINJA2
 
 
+@pass_context
+def secure_random_filter(context, seq):
+    try:
+        return secrets.choice(seq)
+    except IndexError:
+        return context.environment.undefined("No random item, sequence was empty.")
+
+
 def jinja2_formatter(template: str, /, **kwargs: Any) -> str:
     """Format a template using jinja2.
 
@@ -47,7 +57,9 @@ def jinja2_formatter(template: str, /, **kwargs: Any) -> str:
     # Use a restricted sandbox that blocks ALL attribute/method access
     # Only simple variable lookups like {{variable}} are allowed
     # Attribute access like {{variable.attr}} or {{variable.method()}} is blocked
-    return SandboxedEnvironment().from_string(template).render(**kwargs)
+    environment = SandboxedEnvironment()
+    environment.filters['random'] = secure_random_filter
+    return environment.from_string(template).render(**kwargs)
 
 
 def run():
diff --git a/apps/users/serializers/user.py b/apps/users/serializers/user.py
index f499a5afef5..dd76fe7da5f 100644
--- a/apps/users/serializers/user.py
+++ b/apps/users/serializers/user.py
@@ -9,8 +9,8 @@
 import datetime
 import json
 import os
-import random
 import re
+import secrets
 from collections import defaultdict
 
 import uuid_utils.compat as uuid
@@ -1173,8 +1173,7 @@ def send(self):
         email = self.data.get("email")
         state = self.data.get("type")
         # 生成随机验证码
-        code = "".join(list(map(lambda i: random.choice(['1', '2', '3', '4', '5', '6', '7', '8', '9', '0'
-                                                         ]), range(6))))
+        code = "".join(secrets.choice('1234567890') for _ in range(6))
         # 获取邮件模板
         language = get_language()
         file = open(