From 315f8b674a64130028ca86fa5d38c35785881aac Mon Sep 17 00:00:00 2001
From: andres-portainer <91705312+andres-portainer@users.noreply.github.com>
Date: Thu, 6 Aug 2026 09:48:08 -0300
Subject: [PATCH] fix(deps): replace dchest/uniuri with librand.String BE-13306
 (#3377)

---
 api/chisel/tunnel.go            |  5 ++---
 api/datastore/datastore_test.go |  4 ++--
 go.mod                          |  1 -
 go.sum                          |  2 --
 pkg/librand/rand.go             | 12 ++++++++++++
 pkg/librand/rand_test.go        | 20 ++++++++++++++++++++
 6 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/api/chisel/tunnel.go b/api/chisel/tunnel.go
index fa321d7c50..3a8151c1e4 100644
--- a/api/chisel/tunnel.go
+++ b/api/chisel/tunnel.go
@@ -16,7 +16,6 @@ import (
 	"github.com/portainer/portainer/pkg/libcrypto"
 	"github.com/portainer/portainer/pkg/librand"
 
-	"github.com/dchest/uniuri"
 	"github.com/rs/zerolog/log"
 )
 
@@ -223,8 +222,8 @@ func randomInt(min, max int) int {
 }
 
 func generateRandomCredentials() (string, string) {
-	username := uniuri.NewLen(8)
-	password := uniuri.NewLen(8)
+	username := librand.String(8)
+	password := librand.String(8)
 
 	return username, password
 }
diff --git a/api/datastore/datastore_test.go b/api/datastore/datastore_test.go
index 2a76530548..38eb6eba88 100644
--- a/api/datastore/datastore_test.go
+++ b/api/datastore/datastore_test.go
@@ -9,8 +9,8 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/chisel"
 	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/pkg/librand"
 
-	"github.com/dchest/uniuri"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -176,7 +176,7 @@ func (store *Store) testSSLSettings(t *testing.T) {
 
 func (store *Store) testTunnelServer(t *testing.T) {
 	is := assert.New(t)
-	expectPrivateKeySeed := uniuri.NewLen(16)
+	expectPrivateKeySeed := librand.String(16)
 
 	err := store.TunnelServer().UpdateInfo(&portainer.TunnelServerInfo{PrivateKeySeed: expectPrivateKeySeed})
 	require.NoError(t, err, "UpdateInfo should have succeeded")
diff --git a/go.mod b/go.mod
index 76a6526d56..bb9c9a9dfa 100644
--- a/go.mod
+++ b/go.mod
@@ -18,7 +18,6 @@ require (
 	github.com/compose-spec/compose-go/v2 v2.9.1
 	github.com/containerd/containerd v1.7.33
 	github.com/containerd/errdefs v1.0.0
-	github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5
 	github.com/distribution/reference v0.6.0
 	github.com/docker/cli v28.5.1+incompatible
 	github.com/docker/compose/v2 v2.40.3
diff --git a/go.sum b/go.sum
index 8826c0608c..77cad58b56 100644
--- a/go.sum
+++ b/go.sum
@@ -239,8 +239,6 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5 h1:RAV05c0xOkJ3dZGS0JFybxFKZ2WMLabgx3uXnd7rpGs=
-github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5/go.mod h1:GgB8SF9nRG+GqaDtLcwJZsQFhcogVCJ79j4EdT0c2V4=
 github.com/deckarep/golang-set v1.8.0 h1:sk9/l/KqpunDwP7pSjUg0keiOOLEnOBHzykLrsPppp4=
 github.com/deckarep/golang-set v1.8.0/go.mod h1:5nI87KwE7wgsBU1F4GKAw2Qod7p5kyS383rP6+o6qqo=
 github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
diff --git a/pkg/librand/rand.go b/pkg/librand/rand.go
index 10b5321b53..9c0115318a 100644
--- a/pkg/librand/rand.go
+++ b/pkg/librand/rand.go
@@ -33,6 +33,18 @@ func int64n(max int64, fips bool) int64 {
 	return i.Int64()
 }
 
+const alphanumericChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+
+// String returns a random alphanumeric string of length n.
+func String(n int) string {
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = alphanumericChars[int64n(int64(len(alphanumericChars)), true)]
+	}
+
+	return string(b)
+}
+
 func Float64() float64 {
 	return randomFloat64(fips.FIPSMode())
 }
diff --git a/pkg/librand/rand_test.go b/pkg/librand/rand_test.go
index 4644f5e848..d798b38cfd 100644
--- a/pkg/librand/rand_test.go
+++ b/pkg/librand/rand_test.go
@@ -1,9 +1,12 @@
 package librand
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/require"
 )
 
 func init() {
@@ -49,6 +52,23 @@ func TestInternalIntn(t *testing.T) {
 	}
 }
 
+func TestString(t *testing.T) {
+	t.Parallel()
+
+	const iterations = 1000
+
+	seen := make(map[string]bool, iterations)
+	for range iterations {
+		s := String(16)
+
+		require.Len(t, s, 16)
+		require.Empty(t, strings.Trim(s, alphanumericChars))
+		require.False(t, seen[s])
+
+		seen[s] = true
+	}
+}
+
 func TestFloat64(t *testing.T) {
 	t.Parallel()
 	f := Float64()