apache / tsfile

Apache TsFile
https://tsfile.apache.org/
Apache License 2.0
104 stars 50 forks source link

Fix code scanning alert no. 9: Use of a broken or risky cryptographic algorithm #290

Closed HTHou closed 2 weeks ago

HTHou commented 2 weeks ago

Fixes https://github.com/apache/tsfile/security/code-scanning/9

To fix the problem, we need to replace the use of the MD5 algorithm with a stronger, modern cryptographic algorithm. The best way to do this without changing existing functionality is to use SHA-256, which is widely regarded as secure.

  1. General fix: Replace instances of MessageDigest.getInstance("MD5") with MessageDigest.getInstance("SHA-256").
  2. Detailed fix: Update the getNormalKeyStr and getEncryptParameter methods to use SHA-256 instead of MD5.
  3. Specific changes: Modify lines 124 and 157 in the EncryptUtils.java file.
  4. Required imports: No new imports are needed as MessageDigest is already imported.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

codecov-commenter commented 2 weeks ago

Codecov Report

Attention: Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 63.63%. Comparing base (6c4f911) to head (a2e3e0f).

Files with missing lines Patch % Lines
...n/java/org/apache/tsfile/encrypt/EncryptUtils.java 50.00% 1 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## develop #290 +/- ## ======================================== Coverage 63.63% 63.63% ======================================== Files 501 501 Lines 31787 31787 Branches 4110 4110 ======================================== Hits 20228 20228 Misses 11082 11082 Partials 477 477 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.