Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Also find weak crypto in PHP when hash(...) is called #3541

Merged
merged 1 commit into from
Dec 20, 2024

Conversation

Sjord
Copy link
Contributor

@Sjord Sjord commented Dec 18, 2024

MD5 and SHA1 are insecure hash functions. These have their own function names (md5(...), sha1(...)) but can also be calculated using hash('md5', ...) and hash('sha1', ...). Also find these instances and report them as weak crypto.

Also, write out all function names as function calls instead of matching them with a regular expression, for readability and performance reasons.

MD5 and SHA1 are insecure hash functions. These have their own function names (`md5(...)`, `sha1(...)`) but can also be calculated using `hash('md5', ...)` and `hash('sha1', ...)`. Also find these instances and report them as weak crypto.

Also, write out all function names as function calls instead of matching them with a regular expression, for readability and performance reasons.
Copy link
Collaborator

@p4p3r p4p3r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@p4p3r p4p3r merged commit a9aea6c into semgrep:develop Dec 20, 2024
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants