Commits on Apr 10, 2023

1. Adds check for crypt module usage as weak hash …

   The crypt module also permits creating weak hashes such as MD5
   just like hashlib. This change extends the hashlib plugin to add
   the extra checks on calls to crypt.crypt and crypt.mksalt which
   both take a hash method parameter.
   
   The new checks won't necessarily catch all weak hashes available
   as the operating system might provide others that the crypt
   module picks up. But it will capture cases with the default set.
   Namely, METHOD_CRYPT", METHOD_MD5, and METHOD_BLOWFISH.
   
   Also note that crypt.methods is supposed to return a list all
   available hash methods. However, testing has shown that it can
   return just METHOD_CRYPT, the weakest of the bunch. And passing
   None as args to these module functions will default to the
   highest available hash from crypt.methods. So this also can
   be weak by default, but no reliable for Bandit to detect.
   
   https://docs.python.org/3.11/library/crypt.html#module-crypt
   
   Fixes PyCQA#1017
   
   Signed-off-by: Eric Brown <eric_wade_brown@yahoo.com>

   

   ericwb committed Apr 10, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 06ffbae
   • Browse repository at this point

   Copy the full SHA

   06ffbae View commit details

   Browse the repository at this point in the history