Conversation
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
lm_proxy/core.py
Dismissed
| return hashlib.md5( | ||
| (api_key + env.config.encryption_key).encode("utf-8") | ||
| ).hexdigest() | ||
| return hashlib.md5((api_key + env.config.encryption_key).encode("utf-8")).hexdigest() |
Check failure
Code scanning / CodeQL
Use of a broken or weak cryptographic hashing algorithm on sensitive data High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 16 days ago
General approach: replace the use of MD5 with a modern cryptographic hash function from the SHA-2 family (e.g., SHA-256) for deriving this API key identifier. Since this identifier is not a password verifier but a pseudonymous ID, we do not need a slow KDF like bcrypt/Argon2; a simple SHA-256 hash is sufficient and standard.
Best concrete fix without changing functionality: keep the logic and types of api_key_id exactly the same (returns a deterministic hex string based on api_key and env.config.encryption_key), but change hashlib.md5 to hashlib.sha256. This preserves:
- Same function signature and return type (
str | None). - Same salting/combining scheme with
env.config.encryption_key. - Same encoding (
utf-8) and hex-digest format.
Only the length and value of the identifier change, which should be acceptable for any logging/metrics usage and does not affect authorization or API behavior.
Specific changes:
- File:
lm_proxy/core.py - In
api_key_id(around line 151), replace:hashlib.md5(...).hexdigest()
with:hashlib.sha256(...).hexdigest()
- No new imports are needed because
hashlibis already imported at the top of the file.
| @@ -148,7 +148,7 @@ | ||
| """ | ||
| if not api_key: | ||
| return None | ||
| return hashlib.md5((api_key + env.config.encryption_key).encode("utf-8")).hexdigest() | ||
| return hashlib.sha256((api_key + env.config.encryption_key).encode("utf-8")).hexdigest() | ||
|
|
||
|
|
||
| def fail_if_service_disabled(): |
|
@gito is sha256 slower than md5? |
|
But here's the thing: looking at your codebase, you're using MD5 in TL;DR: MD5 is faster, SHA-256 is more secure. Your current MD5 usage for key identification? Totally reasonable. Don't fix what ain't broken. 🎯 |
1 participant
No description provided.