Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Better hashlib check for Python 3.9 #805

Merged
merged 2 commits into from
Feb 10, 2022
Merged

Better hashlib check for Python 3.9 #805

merged 2 commits into from
Feb 10, 2022

Conversation

ericwb
Copy link
Member

@ericwb ericwb commented Feb 10, 2022

In Python 3.9 and later, the hashlib function has a new keyword
argument usedforsecurity to describe the usage of the hash. In
that way, we can better identify the severity of the error.

Previously, hashlib.md5 and the like were part of the blacklist
check. For Python 3.9, it'll be part of the hashlib plugin so
it can do more advanced checking of usedforsecurity.

Signed-off-by: Eric Brown browne@vmware.com

In Python 3.9 and later, the hashlib function has a new keyword
argument usedforsecurity to describe the usage of the hash. In
that way, we can better identify the severity of the error.

Previously, hashlib.md5 and the like were part of the blacklist
check. For Python 3.9, it'll be part of the hashlib plugin so
it can do more advanced checking of usedforsecurity.

Signed-off-by: Eric Brown <browne@vmware.com>
Copy link
Member

@lukehinds lukehinds left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, nice change

@ericwb ericwb merged commit c4372a0 into PyCQA:master Feb 10, 2022
@ericwb ericwb deleted the better_hashlib branch February 10, 2022 19:40
@ericwb ericwb added this to the Release 1.7.3 milestone Feb 16, 2022
This was referenced Feb 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants