Cryptographically Insecure Random Document IDs (which can lead to database collisions)

[probicheaux]

python-firestore/google/cloud/firestore_v1/base_collection.py

Line 627 in b2bfc10

return "".join(random.choice(_AUTO_ID_CHARS) for _ in range(20))

The above line is crpytographically insecure. If the python interpreter calls random.seed(0), then the same sequence of document ids will be generated. This leads to database collisions which is undesirable.

Environment details

• OS type and version: MacOS Tahoe 26.2
• Python version: Python 3.10.1
• pip version: pip 21.2.4
• google-cloud-firestore version: 2.20.0

Steps to reproduce

import random
random.seed(0)

from google.cloud.firestore_v1.base_collection import _auto_id

print(_auto_id())

prints

2Yw4aCQ9gfZ6y1T9eWl5

every time.

Code example

See above

Stack trace

N/A