Skip to content

Adding requests dependencies #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
carmithersh wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Adding requests dependencies #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pythonExample/pythonProj.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ def printme( str ):

def arc4_encrypt_password(key, password):
cipher = ARC4.new(key.encode('utf-8'))
encrypted_password = cipher.encrypt(password.encode('utf-8'))
return hashlib.md5(encrypted_password).hexdigest()
encrypted_passcode = cipher.encrypt(password.encode('utf-8'))
return hashlib.md5(encrypted_passcode).hexdigest()
Copy link

@github-actions github-actions bot May 28, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Static Application Security Testing (SAST) Vulnerability

Severity Finding

Medium		 Unsafe Hash Algorithm
Full description

Overview

An unsafe hash algorithm vulnerability occurs when using a known insecure hash algorithm.
A hash algorithm accepts arbitrary input and generates a hash value - a fixed-length output
that can be used to verify the integrity of data, such as passwords or files.
An insecure hash algorithm in an algorithm that an attacker can use to generate
the same hash value for different input data within a reasonable amount of time
("hash collision attack").

Query operation

In this query we look for any usage of weak hash algorithms

Vulnerable example

from flask import Flask, request
import hashlib

app = Flask(__name__)

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')

    # Vulnerable hashing mechanism (MD5)
    hashed_password = hashlib.md5(password.encode()).hexdigest()

    if check_password(username, hashed_password):
        return 'Login successful'
    else:
        return 'Login failed'

if __name__ == '__main__':
    app.run()

In this example, the application uses the MD5 hashing algorithm
to hash the user's password before storage. MD5 is considered a weak hashing algorithm,
vulnerable to various attacks, including collision attacks and precomputed lookup tables
(hash inversion).

Remediation

Replace any usage of the md5 and sha1 hash algorithms with stronger hash algorithms such
as sha256 -

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')

-    hashed_password = hashlib.md5(password.encode()).hexdigest()
+    hashed_password = hashlib.sha256(password.encode()).hexdigest()

if check_password(username, hashed_password):
    return 'Login successful'
else:
    return 'Login failed'


# Now you can call printme function
printme("Hello from JFROG");
Expand Down
3 changes: 2 additions & 1 deletion requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
PyYAML>3.11
nltk
redis == 4.6.0
redis == 4.6.0
requests >=2.31.0