Predictable WebSocket masking key and handshake nonce in HTTP.jl client

Description

The WebSocket client masking key (ws_send_frame!) and the Sec-WebSocket-Key handshake nonce (ws_random_handshake_key) were generated with rand(UInt8, n), which draws from the task-local Xoshiro256++ PRNG. Xoshiro is not cryptographically secure: its internal state can be recovered from a short run of observed outputs, and every outbound client frame exposes 4 mask bytes on the wire. An on-path observer could therefore recover the RNG state and predict all future masking keys, defeating the RFC 6455 §5.3 anti-cache-poisoning purpose of masking.

Impact

Predictable masking keys could let an on-path attacker who also supplies payload craft wire bytes that a non-conformant transparent proxy parses and caches (request/response smuggling and cache poisoning).

Patches

Fixed in HTTP.jl v2.4.0. A module-level CSPRNG (const WS_CSPRNG = Random.RandomDevice()) now generates both the 4-byte masking key and the 16-byte handshake nonce. The wire format and public API are unchanged.

Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.