Increase entropy for MFA secret (#14290)

Co-authored-by: mattermod <mattermod@users.noreply.github.com>

model/utils.go

@@ -155,15 +155,20 @@ func NewRandomTeamName() string {
 	return teamName
 }
 
+// NewRandomString returns a random string of the given length.
+// The resulting entropy will be (5 * length) bits.
 func NewRandomString(length int) string {
-	var b bytes.Buffer
-	str := make([]byte, length+8)
-	rand.Read(str)
-	encoder := base32.NewEncoder(encoding, &b)
-	encoder.Write(str)
-	encoder.Close()
-	b.Truncate(length) // removes the '==' padding
-	return b.String()
+	data := make([]byte, 1+(length*5/8))
+	rand.Read(data)
+	return encoding.EncodeToString(data)[:length]
+}
+
+// NewRandomBase32String returns a base32 encoded string of a random slice
+// of bytes of the given size. The resulting entropy will be (8 * size) bits.
+func NewRandomBase32String(size int) string {
+	data := make([]byte, size)
+	rand.Read(data)
+	return base32.StdEncoding.EncodeToString(data)
 }
 
 // GetMillis is a convenience method to get milliseconds since epoch.

model/utils_test.go

@@ -5,6 +5,7 @@ package model
 
 import (
 	"bytes"
+	"encoding/base32"
 	"fmt"
 	"net/http"
 	"reflect"
@@ -25,8 +26,16 @@ func TestNewId(t *testing.T) {
 
 func TestRandomString(t *testing.T) {
 	for i := 0; i < 1000; i++ {
-		r := NewRandomString(32)
-		require.Len(t, r, 32)
+		str := NewRandomString(i)
+		require.Len(t, str, i)
+		require.NotContains(t, str, "=")
+	}
+}
+
+func TestRandomBase32String(t *testing.T) {
+	for i := 0; i < 1000; i++ {
+		str := NewRandomBase32String(i)
+		require.Len(t, str, base32.StdEncoding.EncodedLen(i))
 	}
 }