search

joltup / rn-fetch-blob

A project committed to making file access and data transfer easier, efficient for React Native developers.
MIT License
2.81k stars 772 forks source link

Remove support for SHA-1 #635

Open jonthanon opened 3 years ago

jonthanon commented 3 years ago

Our company's security team flagged an issue with rn-fetch-blob's use of SHA-1, here:

https://github.com/joltup/rn-fetch-blob/blob/1933faf02341cbf6d6c3b70c5bfe042d8d71e257/ios/RNFetchBlobFS.m#L602

I realize our code would have to specify SHA-1 in order for it to actually be used, which we don't do, but our security team is still uncomfortable with the presence of any call to CC_SHA1 in any dependency. So I'm here to ask: Is there any chance of removing support for SHA-1 in rn-fetch-blob, or is that untenable?

Details about the concern (yes, this came from a code scanning tool):

The vulnerable code locations use the CC_SHA1 or CryptoKit.Insecure.SHA1 hashing functions, which leverage hashing algorithms that are proven to be vulnerable to collision attacks, and are unsuitable for modern use. Apple officially considers this algorithm insecure. They state in iOS 13 CryptoKit documentation: > "This hash algorithm isn’t considered cryptographically secure, but is provided for backward compatibility with older services that require it. For new services, prefer one of the secure hashes, like SHA512."

wizebin commented 3 years ago

Second request here: https://github.com/joltup/rn-fetch-blob/issues/645