Skip to content

support different hash methods for final hash. #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
HarvsG merged 5 commits into from
Sep 14, 2025
Merged

support different hash methods for final hash. #19

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dbc304d
support different hash methods for final hash.
HarvsG Sep 14, 2025
6d310c8
Update glinet.py
HarvsG Sep 14, 2025
93fb80a
Update glinet.py
HarvsG Sep 14, 2025
f8782cf
Update glinet.py
HarvsG Sep 14, 2025
da21cfa
Update glinet.py
HarvsG Sep 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions gli4py/glinet.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,7 @@
alg = res["alg"]
salt = res["salt"]
nonce = res["nonce"]
hash_method = res.get("hash-method", "md5")

# Step2: Generate cipher text using openssl algorithm
if alg == 1: # MD5
Expand All @@ -106,11 +107,18 @@
password
)
else:
raise ValueError("Router requested unsupported hashing algorithm")
raise ValueError("Router requested unsupported hashing algorithm for cipher password")

# Step3: Generate hash values for login
data = f"{username}:{cipher_password}:{nonce}"
hsh = hashlib.md5(data.encode()).hexdigest()
if hash_method == "md5": # MD5
hsh = hashlib.md5(data.encode()).hexdigest()
Comment thread Dismissed
elif hash_method == "sha256": # SHA-256
hsh = hashlib.sha256(data.encode()).hexdigest()

Check failure

Code scanning / CodeQL

Use of a broken or weak cryptographic hashing algorithm on sensitive data High

Sensitive data (password)
Loading
is used in a hashing algorithm (SHA256) that is insecure for password hashing, since it is not a computationally expensive hash function.
Sensitive data (password)
Loading
is used in a hashing algorithm (SHA256) that is insecure for password hashing, since it is not a computationally expensive hash function.
Sensitive data (password)
Loading
is used in a hashing algorithm (SHA256) that is insecure for password hashing, since it is not a computationally expensive hash function.

Copilot Autofix

AI 11 months ago

To address this genuine issue, we should ensure the client never uses MD5 for hashing login data, and preferentially uses the strongest algorithm the router supports (SHA-512 > SHA-256 > MD5). We should raise a warning or error if the router requests MD5, and consider refusing login unless the router supports at least SHA-256. To implement this, edit the login method in gli4py/glinet.py:

  • In the hashing block for login token generation (hash-method), never process the case where "md5" is selected; instead, raise an error or warning.
  • Update the hashing selection logic to use SHA-512 if available, else SHA-256.
  • Optionally, log warnings when weak algorithms are requested.
    No additional imports are needed as hashlib already supports SHA-256/SHA-512. All changes are within the login method.
Suggested changeset 1
gli4py/glinet.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/gli4py/glinet.py b/gli4py/glinet.py
--- a/gli4py/glinet.py
+++ b/gli4py/glinet.py
@@ -111,14 +111,15 @@
 
             # Step3: Generate hash values for login
             data = f"{username}:{cipher_password}:{nonce}"
-            if hash_method == "md5":  # MD5
-                hsh = hashlib.md5(data.encode()).hexdigest()
-            elif hash_method == "sha256":  # SHA-256
-                hsh = hashlib.sha256(data.encode()).hexdigest()
-            elif hash_method == "sha256":  # SHA-512
+            # Prefer SHA-512, else fallback to SHA-256. Reject MD5.
+            if hash_method.lower() == "sha512":
                 hsh = hashlib.sha512(data.encode()).hexdigest()
+            elif hash_method.lower() == "sha256":
+                hsh = hashlib.sha256(data.encode()).hexdigest()
+            elif hash_method.lower() == "md5":
+                raise ValueError("Router requested weak/insecure hash algorithm (MD5) for login; refusing to proceed.")
             else:
-                raise ValueError("Router requested unsupported hashing algorithm for hash")
+                raise ValueError(f"Router requested unsupported hashing algorithm for hash: {hash_method}")
 
             # Step4: Get sid by login
             res = await self._get_sid(username, hsh)
EOF
@@ -111,14 +111,15 @@

# Step3: Generate hash values for login
data = f"{username}:{cipher_password}:{nonce}"
if hash_method == "md5": # MD5
hsh = hashlib.md5(data.encode()).hexdigest()
elif hash_method == "sha256": # SHA-256
hsh = hashlib.sha256(data.encode()).hexdigest()
elif hash_method == "sha256": # SHA-512
# Prefer SHA-512, else fallback to SHA-256. Reject MD5.
if hash_method.lower() == "sha512":
hsh = hashlib.sha512(data.encode()).hexdigest()
elif hash_method.lower() == "sha256":
hsh = hashlib.sha256(data.encode()).hexdigest()
elif hash_method.lower() == "md5":
raise ValueError("Router requested weak/insecure hash algorithm (MD5) for login; refusing to proceed.")
else:
raise ValueError("Router requested unsupported hashing algorithm for hash")
raise ValueError(f"Router requested unsupported hashing algorithm for hash: {hash_method}")

# Step4: Get sid by login
res = await self._get_sid(username, hsh)
Copilot is powered by AI and may make mistakes. Always verify output.
elif hash_method == "sha256": # SHA-512
hsh = hashlib.sha512(data.encode()).hexdigest()

Check failure

Code scanning / CodeQL

Use of a broken or weak cryptographic hashing algorithm on sensitive data High

Sensitive data (password)
Loading
is used in a hashing algorithm (SHA512) that is insecure for password hashing, since it is not a computationally expensive hash function.
Sensitive data (password)
Loading
is used in a hashing algorithm (SHA512) that is insecure for password hashing, since it is not a computationally expensive hash function.
Sensitive data (password)
Loading
is used in a hashing algorithm (SHA512) that is insecure for password hashing, since it is not a computationally expensive hash function.

Copilot Autofix

AI 11 months ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

else:
raise ValueError("Router requested unsupported hashing algorithm for hash")

# Step4: Get sid by login
res = await self._get_sid(username, hsh)
Expand Down