support different hash methods for final hash. - #19
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if hash_method == "md5": # MD5 | ||
| hsh = hashlib.md5(data.encode()).hexdigest() | ||
| elif hash_method == "sha256": # SHA-256 | ||
| hsh = hashlib.sha256(data.encode()).hexdigest() |
Check failure
Code scanning / CodeQL
Use of a broken or weak cryptographic hashing algorithm on sensitive data High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To address this genuine issue, we should ensure the client never uses MD5 for hashing login data, and preferentially uses the strongest algorithm the router supports (SHA-512 > SHA-256 > MD5). We should raise a warning or error if the router requests MD5, and consider refusing login unless the router supports at least SHA-256. To implement this, edit the login method in gli4py/glinet.py:
- In the hashing block for login token generation (
hash-method), never process the case where"md5"is selected; instead, raise an error or warning. - Update the hashing selection logic to use SHA-512 if available, else SHA-256.
- Optionally, log warnings when weak algorithms are requested.
No additional imports are needed ashashlibalready supports SHA-256/SHA-512. All changes are within theloginmethod.
| @@ -111,14 +111,15 @@ | ||
|
|
||
| # Step3: Generate hash values for login | ||
| data = f"{username}:{cipher_password}:{nonce}" | ||
| if hash_method == "md5": # MD5 | ||
| hsh = hashlib.md5(data.encode()).hexdigest() | ||
| elif hash_method == "sha256": # SHA-256 | ||
| hsh = hashlib.sha256(data.encode()).hexdigest() | ||
| elif hash_method == "sha256": # SHA-512 | ||
| # Prefer SHA-512, else fallback to SHA-256. Reject MD5. | ||
| if hash_method.lower() == "sha512": | ||
| hsh = hashlib.sha512(data.encode()).hexdigest() | ||
| elif hash_method.lower() == "sha256": | ||
| hsh = hashlib.sha256(data.encode()).hexdigest() | ||
| elif hash_method.lower() == "md5": | ||
| raise ValueError("Router requested weak/insecure hash algorithm (MD5) for login; refusing to proceed.") | ||
| else: | ||
| raise ValueError("Router requested unsupported hashing algorithm for hash") | ||
| raise ValueError(f"Router requested unsupported hashing algorithm for hash: {hash_method}") | ||
|
|
||
| # Step4: Get sid by login | ||
| res = await self._get_sid(username, hsh) |
| elif hash_method == "sha256": # SHA-256 | ||
| hsh = hashlib.sha256(data.encode()).hexdigest() | ||
| elif hash_method == "sha256": # SHA-512 | ||
| hsh = hashlib.sha512(data.encode()).hexdigest() |
Check failure
Code scanning / CodeQL
Use of a broken or weak cryptographic hashing algorithm on sensitive data High
Copilot Autofix
AI 11 months ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
2 participants
Should help with: HarvsG/ha-glinet4-integration#40