@@ -16,10 +16,10 @@ fn test_hash_algorithms(
1616 _ = md5:: Md5 :: digest ( encrypted_password) ;
1717
1818 // MD5 (alternative / older library)
19- _ = md5_alt:: compute ( harmless) ;
20- _ = md5_alt:: compute ( credit_card_no) ; // $ Alert[rust/weak-sensitive-data-hashing]
21- _ = md5_alt:: compute ( password) ; // $ Alert[rust/weak-sensitive-data-hashing]
22- _ = md5_alt:: compute ( encrypted_password) ;
19+ _ = md5_alt:: compute ( harmless) ; // $ Alert[rust/summary/cryptographic-operations]
20+ _ = md5_alt:: compute ( credit_card_no) ; // $ Alert[rust/summary/cryptographic-operations] Alert[rust/ weak-sensitive-data-hashing]
21+ _ = md5_alt:: compute ( password) ; // $ Alert[rust/summary/cryptographic-operations] Alert[rust/ weak-sensitive-data-hashing]
22+ _ = md5_alt:: compute ( encrypted_password) ; // $ Alert[rust/summary/cryptographic-operations]
2323
2424 // SHA-1
2525 _ = sha1:: Sha1 :: digest ( harmless) ;
@@ -64,14 +64,14 @@ fn test_hash_code_patterns(
6464 _ = md5:: Md5 :: digest ( password_vec) ; // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
6565
6666 // hash through a hasher object
67- let mut md5_hasher = md5:: Md5 :: new ( ) ;
67+ let mut md5_hasher = md5:: Md5 :: new ( ) ; // $ Alert[rust/summary/cryptographic-operations]
6868 md5_hasher. update ( b"abc" ) ;
6969 md5_hasher. update ( harmless) ;
7070 md5_hasher. update ( password) ; // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
7171 _ = md5_hasher. finalize ( ) ;
7272
73- _ = md5:: Md5 :: new ( ) . chain_update ( harmless) . chain_update ( harmless) . chain_update ( harmless) . finalize ( ) ;
74- _ = md5:: Md5 :: new ( ) . chain_update ( harmless) . chain_update ( password) . chain_update ( harmless) . finalize ( ) ; // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
73+ _ = md5:: Md5 :: new ( ) . chain_update ( harmless) . chain_update ( harmless) . chain_update ( harmless) . finalize ( ) ; // $ Alert[rust/summary/cryptographic-operations]
74+ _ = md5:: Md5 :: new ( ) . chain_update ( harmless) . chain_update ( password) . chain_update ( harmless) . finalize ( ) ; // $ Alert[rust/summary/cryptographic-operations] MISSING: Alert[rust/weak-sensitive-data-hashing]
7575
7676 _ = md5:: Md5 :: new_with_prefix ( harmless) . finalize ( ) ;
7777 _ = md5:: Md5 :: new_with_prefix ( password) . finalize ( ) ; // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
@@ -130,7 +130,7 @@ fn test_hash_structs() {
130130 let str3c = serde_urlencoded:: to_string ( & s3) . unwrap ( ) ;
131131
132132 // hash with MD5
133- let mut md5_hasher = md5:: Md5 :: new ( ) ;
133+ let mut md5_hasher = md5:: Md5 :: new ( ) ; // $ Alert[rust/summary/cryptographic-operations]
134134 md5_hasher. update ( s1. data ) ;
135135 md5_hasher. update ( s2. credit_card_no ) ; // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
136136 md5_hasher. update ( s3. password ) ; // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
@@ -153,8 +153,75 @@ fn test_hash_file(
153153 let mut harmless_file = std:: fs:: File :: open ( harmless_filename) . unwrap ( ) ;
154154 let mut password_file = std:: fs:: File :: open ( password_filename) . unwrap ( ) ;
155155
156- let mut md5_hasher = md5:: Md5 :: new ( ) ;
156+ let mut md5_hasher = md5:: Md5 :: new ( ) ; // $ Alert[rust/summary/cryptographic-operations]
157157 _ = std:: io:: copy ( & mut harmless_file, & mut md5_hasher) ;
158158 _ = std:: io:: copy ( & mut password_file, & mut md5_hasher) ; // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
159159 _ = md5_hasher. finalize ( ) ;
160160}
161+
162+ // ---
163+
164+ struct Seed {
165+ }
166+
167+ impl Seed {
168+ fn new ( _seed_value : u64 ) -> Self {
169+ Seed { }
170+ }
171+ }
172+
173+ fn test_seed ( ) {
174+ // this will be misrecognized as a use of the SEED algorithm, but SEED is strong and the input
175+ // is not sensitive data, so `rust/weak-sensitive-data-hashing` should not report a result here.
176+ let _ = Seed :: new ( 0 ) ; // $ Alert[rust/summary/cryptographic-operations]
177+ }
178+
179+ // ---
180+
181+ struct Sha1 {
182+ }
183+
184+ impl Sha1 {
185+ const fn new ( ) -> Self {
186+ Sha1 { }
187+ }
188+
189+ const fn update ( & mut self , _data : & [ u8 ] ) {
190+ // ...
191+ }
192+
193+ const fn finalize ( self ) -> [ u8 ; 20 ] {
194+ [ 0 ; 20 ]
195+ }
196+ }
197+
198+ fn sha1_test ( password : & [ u8 ] ) {
199+ let mut hasher = Sha1 :: new ( ) ; // $ Alert[rust/summary/cryptographic-operations]
200+ hasher. update ( password) ; // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
201+ _ = hasher. finalize ( ) ;
202+ }
203+
204+ // ---
205+
206+ struct HashCollection {
207+ }
208+
209+ impl HashCollection {
210+ pub fn add_sig ( value : & str ) -> Self {
211+ _ = md5_alt:: compute ( value) ; // $ Alert[rust/summary/cryptographic-operations] Alert[rust/weak-sensitive-data-hashing]
212+
213+ // ...
214+
215+ HashCollection { }
216+ }
217+ }
218+
219+ fn test_hash_collection ( ) {
220+ // this indirectly performs MD5 hashing, but the data is not sensitive
221+ let id: & str = "my_id_1234567890" ;
222+ HashCollection :: add_sig ( id) ;
223+
224+ // this indirectly performs MD5 hashing, and the data is sensitive; the result is reported here
225+ let password: & str = "password123" ;
226+ HashCollection :: add_sig ( password) ; // $ Source
227+ }
0 commit comments