Description

This detector identifies the use of SHA-1 hashing algorithms in Dart code, which are cryptographically weak and vulnerable to collision attacks. SHA-1 should be replaced with stronger alternatives like SHA-256 or SHA-3 for security-sensitive applications.

Detection Strategy

• The code must import the crypto library (package:crypto/crypto.dart)

• There must be a method call or expression that uses crypto conversion functionality

• The receiver of the crypto operation must be defined as a SHA-1 object (likely sha1 hash instance)

• The first argument to the hashing operation must contain potentially dangerous content that could benefit from stronger hashing

Vulnerable code example

import 'package:crypto/crypto.dart';

// Vulnerable: Using SHA-1 with sensitive data
Digest hashPassword(List<int> password) {
  return sha1.convert(password); // SHA-1 is cryptographically weak
}

// Vulnerable: HMAC-SHA1 with credentials...

✅ Secure code example

import 'package:crypto/crypto.dart';

// Secure: Using SHA-256 with sensitive data
Digest hashPassword(List<int> password) {
  return sha256.convert(password); // SHA-256 is cryptographically secure
}

// Secure: HMAC-SHA256 with credentials...