From b08b0bc732f2caaca9fcf9f54e5a4daedf752755 Mon Sep 17 00:00:00 2001 From: edithatogo <15080672+edithatogo@users.noreply.github.com> Date: Tue, 28 Jul 2026 14:56:44 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Security=20fix:=20Replace=20weak?= =?UTF-8?q?=20SHA-1=20hash=20with=20SHA-256?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🎯 **What:** Replaced the use of the `hashlib.sha1` hashing algorithm with `hashlib.sha256` in `_unique_id`. ⚠️ **Risk:** MD5 and SHA-1 algorithms are considered cryptographically weak and are vulnerable to collision attacks, which could theoretically allow attackers to craft inputs resulting in the same identifier. 🛡️ **Solution:** Replaced `hashlib.sha1` with `hashlib.sha256`, which is a modern, cryptographically secure hash function. Retained the 8-character string truncation for backwards compatibility and identical format length. --- converters/fixtures/src/pic_fixture_converters/core.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/converters/fixtures/src/pic_fixture_converters/core.py b/converters/fixtures/src/pic_fixture_converters/core.py index 40373e4b..36da7a39 100644 --- a/converters/fixtures/src/pic_fixture_converters/core.py +++ b/converters/fixtures/src/pic_fixture_converters/core.py @@ -350,7 +350,7 @@ def _pic_id(native_name: str, *, dialect: Dialect, crosswalk: Crosswalk | None) def _unique_id(pic_id: str, path: tuple[str, ...], id_map: dict[str, str]) -> str: if pic_id not in id_map: return pic_id - digest = hashlib.sha1("/".join(path).encode("utf-8")).hexdigest()[:8] + digest = hashlib.sha256("/".join(path).encode("utf-8")).hexdigest()[:8] base, suffix = pic_id.rsplit(".", 1) return f"{base}_{digest}.{suffix}"