microsoft / microsoft/react-native-windows
Weak cryptography by NodeJS library error
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 17.3k
- Forks
- 1.2k
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 33
Description
Problem Description
CodeQL reports 1 Weak cryptography by NodeJS library error in the Hash.ts file.
Steps To Reproduce
Link to CodeQL (corpnet-only): https://onees.lgtm.microsoft.com/projects/u/gh/microsoft%2Freact-native-windows%2Ftree%2Fmain/alerts/?mode=tree&ruleFocus=1001395
Expected Results
No response
CLI version
npx react-native --version
Environment
npx react-native info
Target Platform Version
No response
Target Device(s)
No response
Visual Studio Version
No response
Build Configuration
No response
Snack, code example, screenshot, or link to a repository
Source root/packages/…/src/Hash.ts1 alert| ↑ | 1-51 |
|---|---|
| 52 | |
| 53 | constructor(hashOpts?: HashOpts) { |
| 54 | this.hash = crypto.createHash('sha1'); |
| Weak hash algorithms are banned by the SDL. Switch to a SHA2 based cryptographic hash instead. | |
| 55 | this.hashOpts = hashOpts || {}; |
| 56 | } |
| ↓ | 57-106 |
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in packages/react-native-platform-override/src/Hash.ts at the constructor on line 54, where the CodeQL alert identifies crypto.createHash('sha1'). Review the surrounding hash options and usage, then replace the weak hash with an appropriate SHA2-based hash and rerun the referenced CodeQL check to confirm the alert is cleared.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100