SAMLAuthenticator.generatePassword(...) does not use same probability for all chars

[Marcono1234]

It appears SAMLAuthenticator.generatePassword(int) does not use the same probability for all chars:

jira-saml/src/com/lastpass/jira/SAMLAuthenticator.java

Lines 112 to 122 in 52f4b62

	char[] chars =
	"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()".toCharArray();
	byte[] bytes = new byte[len];
	char[] pw = new char[len];
	new SecureRandom().nextBytes(bytes);
	for (i=0; i < bytes.length; i++) {
	int randval = bytes[i] & 0xff;
	pw[i] = chars[randval % chars.length];
	}
	return String.valueOf(pw);

There are 72 chars but a char is picked using effectively random(0, 255) % 72. Therefore the first 40 (= 256 % 72) chars are picked with a probability of 4/7, while the remaining 32 chars are picked with a probability of 3/7.

Though this is likely not that dramatic.