class RuboCop::Cop::GitHub::InsecureHashAlgorithm

Constants

DEFAULT_ALLOWED

Built-in hash functions are listed in these docs:

https://ruby-doc.org/stdlib-2.7.0/libdoc/digest/rdoc/Digest.html
https://ruby-doc.org/stdlib-2.7.0/libdoc/openssl/rdoc/OpenSSL/Digest.html
MSG
UUID_V3_MSG
UUID_V5_MSG

Public Instance Methods

alg_name(val) click to toggle source
# File lib/rubocop/cop/github/insecure_hash_algorithm.rb, line 99
def alg_name(val)
  return :nil if val.nil?
  return val.to_s.downcase unless val.is_a?(RuboCop::AST::Node)
  case val.type
  when :sym, :str
    val.children.first.to_s.downcase
  else
    val.type
  end
end
allowed_hash_functions() click to toggle source
# File lib/rubocop/cop/github/insecure_hash_algorithm.rb, line 95
def allowed_hash_functions
  @allowed_algorithms ||= cop_config.fetch("Allowed", DEFAULT_ALLOWED).map(&:downcase)
end
insecure_algorithm?(val) click to toggle source
# File lib/rubocop/cop/github/insecure_hash_algorithm.rb, line 65
def insecure_algorithm?(val)
  return false if val == :Digest # Don't match "Digest::Digest".
  case alg_name(val)
  when *allowed_hash_functions
    false
  when Symbol
    # can't figure this one out, it's nil or a var or const.
    false
  else
    true
  end
end
just_encoding?(val) click to toggle source
# File lib/rubocop/cop/github/insecure_hash_algorithm.rb, line 82
def just_encoding?(val)
  val == :hexencode || val == :bubblebabble
end
not_just_encoding?(val) click to toggle source
# File lib/rubocop/cop/github/insecure_hash_algorithm.rb, line 78
def not_just_encoding?(val)
  !just_encoding?(val)
end
on_const(const_node) click to toggle source
# File lib/rubocop/cop/github/insecure_hash_algorithm.rb, line 110
def on_const(const_node)
  if insecure_const?(const_node) && !digest_uuid?(const_node)
    add_offense(const_node, message: MSG)
  end
end
on_send(send_node) click to toggle source
# File lib/rubocop/cop/github/insecure_hash_algorithm.rb, line 116
def on_send(send_node)
  case
  when uuid_v3?(send_node)
    unless allowed_hash_functions.include?("md5")
      add_offense(send_node, message: UUID_V3_MSG)
    end
  when uuid_v5?(send_node)
    unless allowed_hash_functions.include?("sha1")
      add_offense(send_node, message: UUID_V5_MSG)
    end
  when openssl_hmac_new?(send_node)
    if openssl_hmac_new_insecure?(send_node)
      add_offense(send_node, message: MSG)
    end
  when insecure_digest?(send_node)
    add_offense(send_node, message: MSG)
  when insecure_hash_lookup?(send_node)
    add_offense(send_node, message: MSG)
  end
end