From 0732657ab1ebda619d203fa5200056311a764bca Mon Sep 17 00:00:00 2001
From: Thierry Boileau <thierry.boileau@qlik.com>
Date: Sun, 8 Mar 2026 17:41:37 +0100
Subject: [PATCH] Issue #1487: reuse Random instance

---
 changes.md                                        |  3 ++-
 .../src/main/java/org/restlet/routing/Router.java |  6 +++---
 .../src/main/java/org/restlet/util/RouteList.java | 15 +++++++++------
 3 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/changes.md b/changes.md
index 559a27efa8..ea847a2e20 100644
--- a/changes.md
+++ b/changes.md
@@ -2,7 +2,8 @@ Changes log
 ===========
 
 - 2.7 Milestone 3 (??-??-2025)
-
+  - Bugs fixed
+    - Reuse an instance of Random class in RandomUtils. Issue #1487.
 - 2.7 Milestone 2 (29-06-2025)
     - Misc
       - Removed deprecated Servlet extension and related classes in Spring extension
diff --git a/org.restlet/src/main/java/org/restlet/routing/Router.java b/org.restlet/src/main/java/org/restlet/routing/Router.java
index a35b73a990..bdcdab3ff8 100644
--- a/org.restlet/src/main/java/org/restlet/routing/Router.java
+++ b/org.restlet/src/main/java/org/restlet/routing/Router.java
@@ -34,7 +34,7 @@
  * <li>First match (default)</li>
  * <li>Last match</li>
  * <li>Random match</li>
- * <li>Round robin</li>
+ * <li>Round-robin</li>
  * <li>Custom</li>
  * </ul>
  * <br>
@@ -53,7 +53,7 @@
 public class Router extends Restlet {
 
 	/**
-	 * Each call will be routed to the route with the best score, if the required
+	 * Each call will be routed to the route with the best score if the required
 	 * score is reached. See {@link RouteList#getBest(Request, Response, float)}
 	 * method for implementation details.
 	 */
@@ -94,7 +94,7 @@ public class Router extends Restlet {
 
 	/**
 	 * Each call will be randomly routed to one of the routes that reached the
-	 * required score. If the random route selected is not a match then the
+	 * required score. If the random route selected is not a match, then the
 	 * immediate next route is evaluated until one matching route is found. If we
 	 * get back to the initial random route selected with no match, then we return
 	 * null. Unless all the routes score above the required score, this mode will
diff --git a/org.restlet/src/main/java/org/restlet/util/RouteList.java b/org.restlet/src/main/java/org/restlet/util/RouteList.java
index 13063307f2..328544742a 100644
--- a/org.restlet/src/main/java/org/restlet/util/RouteList.java
+++ b/org.restlet/src/main/java/org/restlet/util/RouteList.java
@@ -14,6 +14,7 @@
 import org.restlet.Restlet;
 import org.restlet.routing.Route;
 
+import java.security.SecureRandom;
 import java.util.Collections;
 import java.util.List;
 import java.util.Random;
@@ -34,14 +35,16 @@
  * @see java.util.List
  */
 public final class RouteList extends WrapperList<Route> {
-	/** The index of the last route used in the round robin mode. */
+	/** The index of the last route used in the round-robin mode. */
 	private volatile int lastIndex;
+	/** Used when asked to return a random route. */
+	private final SecureRandom random = new SecureRandom();
 
 	/**
 	 * Constructor.
 	 */
 	public RouteList() {
-		super(new CopyOnWriteArrayList<Route>());
+		super(new CopyOnWriteArrayList<>());
 		this.lastIndex = -1;
 	}
 
@@ -51,7 +54,7 @@ public RouteList() {
 	 * @param delegate The delegate list.
 	 */
 	public RouteList(List<Route> delegate) {
-		super(new CopyOnWriteArrayList<Route>(delegate));
+		super(new CopyOnWriteArrayList<>(delegate));
 		this.lastIndex = -1;
 	}
 
@@ -159,7 +162,7 @@ public synchronized Route getRandom(Request request, Response response, float re
 		int length = size();
 
 		if (length > 0) {
-			int j = new Random().nextInt(length);
+			int j = random.nextInt(length);
 			Route route = get(j);
 
 			if (route.score(request, response) >= requiredScore) {
@@ -169,7 +172,7 @@ public synchronized Route getRandom(Request request, Response response, float re
 			boolean loopedAround = false;
 
 			do {
-				if ((j == length) && (!loopedAround)) {
+				if ((j == length) && !loopedAround) {
 					j = 0;
 					loopedAround = true;
 				}
@@ -187,7 +190,7 @@ public synchronized Route getRandom(Request request, Response response, float re
 	}
 
 	/**
-	 * Removes all routes routing to a given target.
+	 * Removes all routes to a given target.
 	 * 
 	 * @param target The target Restlet to detach.
 	 */