'md5/sha1-

Author: caplinje-NOAA

dash/_callback.py

@@ -535,7 +535,7 @@ def register_clientside_callback(
     if isinstance(clientside_function, str):
         namespace = "_dashprivate_clientside_funcs"
         # Create a hash from the function, it will be the same always
-        function_name = hashlib.md5(clientside_function.encode("utf-8")).hexdigest()
+        function_name = hashlib.sha256(clientside_function.encode("utf-8")).hexdigest()
 
         inline_scripts.append(
             _inline_clientside_template.format(

dash/_utils.py

@@ -142,7 +142,7 @@ def _concat(x):
         _id = x.component_id_str().replace(".", "\\.") + "." + x.component_property
         if x.allow_duplicate:
             if not hashed_inputs:
-                hashed_inputs = hashlib.md5(
+                hashed_inputs = hashlib.sha256(
                     ".".join(str(x) for x in inputs).encode("utf-8")
                 ).hexdigest()
             # Actually adds on the property part.
@@ -213,9 +213,9 @@ def run_command_with_process(cmd):
                 proc.communicate()
 
 
-def compute_md5(path):
+def compute_hash(path):
     with io.open(path, encoding="utf-8") as fp:
-        return hashlib.md5(fp.read().encode("utf-8")).hexdigest()
+        return hashlib.sha256(fp.read().encode("utf-8")).hexdigest()
 
 
 def job(msg=""):

dash/development/_jl_components_generation.py

@@ -416,7 +416,7 @@ def generate_toml_file(project_shortname, pkg_data):
     u = uuid.UUID(jl_dash_uuid)
 
     package_uuid = uuid.UUID(
-        hex=u.hex[:-12] + hashlib.md5(package_name.encode("utf-8")).hexdigest()[-12:]
+        hex=u.hex[:-12] + hashlib.sha256(package_name.encode("utf-8")).hexdigest()[-12:]
     )
 
     authors_string = (

dash/development/build_process.py

@@ -8,7 +8,7 @@
 import fire
 import requests
 
-from .._utils import run_command_with_process, compute_md5, job
+from .._utils import run_command_with_process, compute_hash, job
 
 logger = logging.getLogger(__name__)
 coloredlogs.install(
@@ -97,7 +97,8 @@ def digest(self):
             logger.info("bundles in %s %s", folder, copies)
 
             for copy in copies:
-                payload[f"MD5 ({copy})"] = compute_md5(self._concat(folder, copy))
+                # note md5 has been replaced with sha256, leaving string 'MD5 (hash)' as is because impacts are unclear
+                payload[f"MD5 ({copy})"] = compute_hash(self._concat(folder, copy)) 
 
         with open(self._concat(self.main, "digest.json"), "w", encoding="utf-8") as fp:
             json.dump(payload, fp, sort_keys=True, indent=4, separators=(",", ":"))

dash/long_callback/managers/__init__.py

@@ -73,7 +73,7 @@ def build_cache_key(self, fn, args, cache_args_to_ignore):
                 # Call cache function
                 hash_dict[f"cache_key_{i}"] = cache_item()
 
-        return hashlib.sha1(str(hash_dict).encode("utf-8")).hexdigest()
+        return hashlib.sha256(str(hash_dict).encode("utf-8")).hexdigest()
 
     def register(self, key, fn, progress):
         self.func_registry[key] = self.make_job_fn(fn, progress, key)
@@ -102,6 +102,6 @@ def _make_progress_key(key):
     def hash_function(fn, callback_id=""):
         fn_source = inspect.getsource(fn)
         fn_str = fn_source
-        return hashlib.sha1(
+        return hashlib.sha256(
             callback_id.encode("utf-8") + fn_str.encode("utf-8")
         ).hexdigest()