Right now, 4x4 is the only scrambler that behaves differently in tnoodlejs than tnoodle.

Actual (problem) behavior

tnoodle-lib depends on a version of log4j that includes a severe security vulnerability as described here: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

Expected behavior

tnoodle-lib should depend on log4j version 2.16.0 or later. This should be as simple as updating a build dependency and running some tests to make sure nothing breaks.

Steps To Reproduce

1. Build tnoodle-lib or a dependent project like my tnoodle-cli and see that it downloads log4j version 2.13.3

Desktop (please complete the following information):

• OS: MacOS and Windows
• Browser including version n/a
• TNoodle Version: latest (0.18.0)
• Java version: I'm using Java 11 which is generally considered safe from this CVE, but since tnoodle-lib also runs on Java 8, it should be upgraded to prevent any issues from users of that Java version.

Screenshots [OPTIONAL])

My gradle build cache after building tnoodle-lib from source showing the dependency on a vulnerable version of log4j

Additional context [OPTIONAL]

I'll just share the link to the official CVE description again for ease of access.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

See thewca/tnoodle#156 (comment) for renaming the variables, and thewca/tnoodle#156 (comment) for checking that pyraminx and 222 are always solvable in exactly God's number turns.

@chenshuang, do you think you can take this issue on when you've got some free time? There's no immediate rush here, but it's definitely something that should be done eventually.

See email thread here https://groups.google.com/d/msg/wca-software-public/xSX4kH_uzkc/htTY1VLM-v0J.

The gist of it:

Jaap suggests the following:

1. scramble single moves
2. scramble double moves
3. scramble triple moves
4. 5 sets of (single, double, triple move)

(for 7x7)

A year or so ago, I was trying to build an Android cube timer app. However, I found it quite difficult to find out how to use the tnoodle library for generating scrambles and scramble images. Ultimately, I figured out the usage from looking at the code of other projects using tnoodle-lib on GitHub and the tnoodle-samples repository, but this was quite tedious and time consuming, even though using tnoodle-lib for generating scrambles is actually very easy and only takes a few lines of code.

To make it easier and more accessible for people to use tnoodle-lib in their own projects, would it be possible to add some simple code snippets that show how to generate scrambles and scramble SVG strings for various kinds of puzzles in the README file of this repository or the tnoodle-samples repository?
For example, for generating a scramble for a 3x3x3 cube, the code sample could be something simple like

Puzzle puzzle = new ThreeByThreeCubePuzzle();
String scramble = puzzle.generateScramble();

and for generating a scramble SVG string, the code sample could be something like

Puzzle puzzle = new ThreeByThreeCubePuzzle();
String scramble = puzzle.generateScramble();
String SVGString = puzzle.drawScramble(scramble, null).toString();

There was a post in CF today asking about repeated 2x2 scrambles, and someone found a duplicate 2x2 scramble within the same comp. This should probably be filtered out.

Scrambles ending in the same state but in a different orientation should be considered duplicates. However, whether a scramble that is the same as another scramble applied to a different starting orientation is a dupliate needs to be discussed.

As a developer, I'd like to use tnoodle-lib for web/desktop/iOS platforms.
I think it's possible to rewrite the code so it can be used in Kotlin multiplatform projects. Any thoughts on this?

Hello,

I've been writing a cubing tool for myself and scrambles have proven to be the hairiest part of the implementation. I've been hoping to avoid what I'm suggesting but I can't see any other tool in JavaScript that generates acceptable scrambles across different puzzles.

I have looked into the generated tnoodle.js file but this is far from ideal and has (unnecessary) dependencies on global objects (like window or document).

I have been reading through the codebase a little in preparation of a JS port and I just wanted to ask here if there are any upcoming plans to rewrite tNoodle. It doesn't have to be JS but I feel like the codebase needs a bit of cleaning up (I would like to understand the decision behind tightly coupling the representation of puzzles (svg) to the scramble generator).

I feel like I will go ahead with a JS port and make it available on npm (don't know when I will finisih it) and I would greatly appreciate if you could give me some pointers on where I should start within tNoodle, like general pointers to keep in mind.

Thanks a lot!

Hey there, sorry for opening an issue for this, I tried to find any other resources of how are the official scrambles generated for competitions.

I'm currently working on a timer app, written in Python. The way I implemented the scramble generation is not the best nor the official way. I would like to implement official scrambles into my app and possibly make a Python module out of it. If you all are ok with it.

I don't need actual code, just an explanation of how it is done.

Thanks

Hi! On android library when I make a scramble I see this exception:

E/Puzzle: Couldn't get SecureRandomInstance java.security.NoSuchProviderException: SUN at java.security.SecureRandom.getInstance(SecureRandom.java:186) at net.gnehzr.tnoodle.scrambles.Puzzle.getSecureRandom(Puzzle.java:124) at net.gnehzr.tnoodle.scrambles.Puzzle.<init>(Puzzle.java:120) at puzzle.MegaminxPuzzle.<init>(MegaminxPuzzle.java:65) at java.lang.reflect.Constructor.newInstance(Native Method) at net.gnehzr.tnoodle.utils.LazyInstantiator.newInstance(LazyInstantiator.java:85) at net.gnehzr.tnoodle.utils.LazyInstantiator.cachedInstance(LazyInstantiator.java:104)

I see this when I call the cached instance of a LazyIntantiator:

LazyInstantiator<Puzzle> lazyPuzzle = Constants.getInstance().WCA_PUZZLES.get(shortName); try { puzzle = lazyPuzzle.cachedInstance(); } catch (LazyInstantiatorException e) { Log.wtf("ScrambleConfig", e); }

Could you help me please? I'm not sure why is this happening.

This seems not to affect the scramble but I'm a little worried of the impact in production.

Thank you!

Right now, we use SecureRandom, which is implemented differently on different platforms. For WCA scrambles, that's fine, because we assume that each of these different implementations is cryptographically secure. However, for seeded scrambles (good for 2 people racing), we want the scrambles we generate to always been the same, regardless of platform. Perhaps we should add in a MersenneTwister (Yarrow? Fortuna?) implementation, specifically for seeded scrambles?

In big cube scrambles, a sequence with unnecessarily many regrips might appear, such as "Rw Lw' R2 L", where all the moves are across the same axis, and therefore the order of them doesn't change the scramble state.

My proposal is that anytime moves on the same axis appear in sequence, they are sorted, such that you perform all moves starting with the same letter first, e.g. "L' Lw 3Lw2 3Rw Rw' R2" instead of switching back and forth between L and R.
i propose sorting moves left to right, top to bottom, and front to back, but i'm impartial to the directions.

This part of the README: https://github.com/thewca/tnoodle-lib/blame/master/README.md#L58 links to https://bintray.com/thewca, which gives a 410 Gone. Is there a working link?

These are annoying, and can't be controlled in the same way that logging can. Plus, thewca/tnoodle#112 kind of requires this.

This issue can be closed once we've gone through all our code and removed the offending calls, and then added a precommit hook to make sure we don't add any new ones.