Always generate host secrets of correct length.

remoting/host/host_secret.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/host/host_secret.h"
 
+#include <iomanip>
+#include <sstream>
 #include <vector>
 
 #include "base/logging.h"
 #include "base/rand_util.h"
 #include "base/string_number_conversions.h"
 
 namespace remoting {
 
 namespace {
 
 // 5 digits means 100K possible host secrets with uniform distribution, which
 // should be enough for short-term passwords, given that we rate-limit guesses
 // in the cloud and expire access codes after a small number of attempts.
-const int kMaxHostSecret = 100000;
+const int kHostSecretLength = 5;
+const int kMaxHostSecret = 100000;  // Must be equal 10^kHostSecretLength.

[Wez, 2011/11/30 00:34:26]

Can this be 10^kHostSecretLength, or will that end up being calculated at
run-time?

[Sergey Ulanov, 2011/11/30 01:12:26]

Done.

 
 // Generates cryptographically strong random number in the range [0, max).
 int CryptoRandomInt(int max) {
   uint64 random_int32;
   base::RandBytes(&random_int32, sizeof(random_int32));
   return random_int32 % max;
 }
 
 }  // namespace
 
 std::string GenerateSupportHostSecret() {
-  return base::IntToString(CryptoRandomInt(kMaxHostSecret));
+  std::stringstream out;
+  out << std::setfill('0') << std::setw(kHostSecretLength)
+      << CryptoRandomInt(kMaxHostSecret);
+  return out.str();

[Wez, 2011/11/30 00:34:26]

Ick.  Beginning to think the byte-by-byte version was simpler...  Is this really
the simplest way to do this in C++?

[Sergey Ulanov, 2011/11/30 01:12:26]

Yes. Some other code in chromium uses the same approach, e.g. logging. Two other
ways to do it I can think of:
 1. add zeros with while loop,
 2. use sprintf,
None of these would be prettier than the current version.

 }
 
 }  // namespace remoting