Description

Detects the use of MD5 hashing algorithm in Swift applications, which is cryptographically broken and unsuitable for secure hashing. MD5 is vulnerable to collision attacks and should not be used for security-critical operations like password hashing or digital signatures.

Detection Strategy

• Check if the Swift source code imports crypto-related libraries like 'CryptoKit' or 'CommonCrypto'

• Look for method calls or expressions that use MD5 hashing functions

• Report a vulnerability when MD5 hashing operations are found in the code

Vulnerable code example

import CryptoKit
import CommonCrypto

func hashPassword(input: String) {
    guard let data = input.data(using: .utf8) else { return }
    
    // VULNERABLE: Using weak MD5 hash which is cryptographically broken
    let md5Hash = Insecure.MD5.hash(data: data)...

✅ Secure code example

import CryptoKit

func hashPassword(input: String) -> String {
    guard let data = input.data(using: .utf8) else { return "" }
    
    // SECURE: Using SHA256 for cryptographically secure hashing
    let hashedPassword = SHA256.hash(data: data)
    ...