Description

This detector identifies PHP code that uses weak cryptographic hashing algorithms (e.g., MD5, SHA1) within HMAC (Hash-based Message Authentication Code) operations when processing sensitive data. Using weak hash algorithms in HMAC functions reduces the integrity and authenticity guarantees of message authentication, making it susceptible to collision attacks and potentially exposing sensitive information.

Detection Strategy

• Flag calls to HMAC-related PHP functions (e.g., `hash_hmac`) when two conditions are simultaneously met: the function is passed a sensitive message (e.g., passwords, tokens, or other sensitive data as arguments), AND the specified hashing algorithm argument is a known weak algorithm such as MD5, SHA1, or similar.

• Flag calls to PHP's `hash_update` function when: the first argument references a hashing context that was previously initialized with a weak HMAC algorithm (traced back through the context creation call), AND the data being updated includes a sensitive message value.

Vulnerable code example

<?php

const HMAC_ALGORITHM = 'MD5';

// Unsafe case 1
function hashPassword(string $password, string $secret): string
{
    return hash_hmac('sha1', $password, $secret); // SHA1 is cryptographically weak...

✅ Secure code example

<?php

const HMAC_ALGORITHM = 'sha256'; // Use a strong algorithm constant

// Fixed case 1: Replace SHA1 with SHA256
function hashPassword(string $password, string $secret): string
{
    return hash_hmac('sha256', $password, $secret);...