Getting some security issues

[devsideal]

This issue is referred from: https://github.com/firebase/flutterfire/issues/13053

Getting some security issues when scanning by appsweep with below packages:

cloud_firestore: ^5.0.1 showing Insecure hashing algorithm MD5 used with below findings:

firebase_auth: ^5.1.0 showing Insecure hashing algorithm SHA1 used with below findings:

firebase_messaging: ^15.0.1 showing Insecure hashing algorithm SHA-1 used with below findings:

STR:

1. Add all the given three packages and sync
2. Build apk file
3. Test the apk with any security testing tool like appsweep
4. You will see that security issues.

Flutter version is: 3.22.2

[google-oss-bot]

I found a few problems with this issue:

• I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.
• This issue does not seem to follow the issue template. Make sure you provide all the required information.

[dconeybe]

Drive-by comment: Firestore does indeed use MD5, but not in a security context:

https://github.com/firebase/firebase-android-sdk/blob/ec68af618192de27d80a15e99fe9655d4629f2af/firebase-firestore/src/main/java/com/google/firebase/firestore/remote/BloomFilter.java#L141

This code is part of the algorithm that keeps Firestore's local cache in sync with the server. This is not a security context. The warning about using an insecure hash algorithm can be safely ignored. We chose MD5 over a cryptographically-secure hashing algorithm because the performance of MD5 was measured to be significantly better and security was not needed for this particular hash.

[devsideal]

Thanks @dconeybe for the clarification, What's about the other issues?

[dconeybe]

I've added the "auth" tag so someone with auth expertise can comment.

[gsakakihara]

https://github.com/firebase/firebase-android-sdk/blob/f23f6f11610640d767dcda65702a21a7d61f5d27/firebase-messaging/src/main/java/com/google/firebase/messaging/GmsRpc.java#L247

firebase-messaging is using that value as an identifier for deduplication, not security, so there shouldn't be a security issue using SHA-1.