Make Redash FIPS Compliant by adding useforsecurity=False flag to md5 hashes

[ezraodio1]

What type of PR is this?

• Refactor
• Feature
• Bug Fix
• New Query Runner (Data Source)
• New Alert Destination
• Other

Description

Set usedforsecurity=False for md5 hashes. This is a requirement for FIPS compliance.

How is this tested?

• Unit tests (pytest, jest)
• E2E Tests (Cypress)
• Manually
• N/A

Related Tickets & Documents

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

[eradman]

The useforsecurity flag was made available in Python 3.9. Everything works after enabling FIPS!

sudo apt-get -qq install crypto-policies
sudo fips-mode-setup --enable
sudo reboot
...
make up
make create_database

Tests also pass with FIPS enabled.

No adjustment is requried for PostgreSQL since scram-sha-256 was set as the default authentication method since 14.0

[justinclift]

Interesting. Looks like the backend unit tests are failing, but I'm not real sure that's anything to do with this PR:

 45.88   • Installing xlsxwriter (1.2.2)
63.95 Warning: The file chosen for install of requests 2.32.0 (requests-2.32.0-py3-none-any.whl) is yanked.
Reason for being yanked: Yanked due to conflicts with CVE-2024-35195 mitigation

[eradman]

Interesting. Looks like the backend unit tests are failing, but I'm not real sure that's anything to do with this PR:

 45.88   • Installing xlsxwriter (1.2.2)
63.95 Warning: The file chosen for install of requests 2.32.0 (requests-2.32.0-py3-none-any.whl) is yanked.
Reason for being yanked: Yanked due to conflicts with CVE-2024-35195 mitigation

Yeah, we need to update these dependencies since an upstream PIP module was yanked. After that's fixed we can rebase this change

[justinclift]

Looks like it'll probably pass now that the requests module update was merged. 😄

[justinclift]

Looks good to me. 😄

[justinclift]

Thanks for getting this done @ezraodio1, and taking care of the requests problem @eradman. 😄