Adding requests dependencies

[carmithersh]

No description provided.

[github-actions]

---

🐸 JFrog Frogbot

[github-actions]

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Medium	Unsafe Hash Algorithm

Full description

Overview

An unsafe hash algorithm vulnerability occurs when using a known insecure hash algorithm.
A hash algorithm accepts arbitrary input and generates a hash value - a fixed-length output
that can be used to verify the integrity of data, such as passwords or files.
An insecure hash algorithm in an algorithm that an attacker can use to generate
the same hash value for different input data within a reasonable amount of time
("hash collision attack").

Query operation

In this query we look for any usage of weak hash algorithms

Vulnerable example

from flask import Flask, request
import hashlib

app = Flask(__name__)

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')

    # Vulnerable hashing mechanism (MD5)
    hashed_password = hashlib.md5(password.encode()).hexdigest()

    if check_password(username, hashed_password):
        return 'Login successful'
    else:
        return 'Login failed'

if __name__ == '__main__':
    app.run()

In this example, the application uses the MD5 hashing algorithm
to hash the user's password before storage. MD5 is considered a weak hashing algorithm,
vulnerable to various attacks, including collision attacks and precomputed lookup tables
(hash inversion).

Remediation

Replace any usage of the md5 and sha1 hash algorithms with stronger hash algorithms such
as sha256 -

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')

-    hashed_password = hashlib.md5(password.encode()).hexdigest()
+    hashed_password = hashlib.sha256(password.encode()).hexdigest()

if check_password(username, hashed_password):
    return 'Login successful'
else:
    return 'Login failed'

---

🐸 JFrog Frogbot