Description

Detects the usage of cryptographically weak hash algorithms (like MD5, SHA1) in Swift applications when processing sensitive data. These legacy hash functions are considered cryptographically broken and can lead to hash collisions, making them unsuitable for security-critical operations like password hashing or digital signatures.

Detection Strategy

• Check if the Swift code imports CryptoKit or CommonCrypto libraries

• Look for calls to known weak hash functions (e.g., MD5, SHA1) from these crypto libraries

• Verify if the weak hash function is being used with sensitive data like passwords or security credentials

• Flag the code location if a weak hash algorithm is used in a security context

Vulnerable code example

import Foundation
import CryptoKit
import CommonCrypto

func hashPassword(input: String) {
    guard let data = input.data(using: .utf8) else { return }
    
    // VULNERABLE: Using cryptographically broken MD4 hash...

✅ Secure code example

import Foundation
import CryptoKit

func hashPassword(input: String) -> String {
    guard let data = input.data(using: .utf8) else { return "" }
    
    // SECURE: Using SHA256 with salt for password hashing
    let salt = Data((0..<32).map { _ in UInt8.random(in: 0...255) })...