Uploaded image for project: 'Nuxeo Drive '
  1. Nuxeo Drive
  2. NXDRIVE-1430

Use SHA256 for Note checksum

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 4.0.0
    • Fix Version/s: 4.0.1
    • Component/s: Framework, Security

      Description

      Running bandit -r nxdrive highlights this security issue:

      >> Issue: [B303:blacklist] Use of insecure MD2, MD4, MD5, or SHA1 hash function.
         Severity: Medium   Confidence: High
         Location: nxdrive/objects.py:165
         More Info: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b303-md5
      164                     else:
      165                         m = hashlib.md5()
      166                         m.update(note.encode("utf-8"))
      

      Even if this is not crucial, we can simple swith to SHA256.

        Attachments

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 15 minutes
                15m