Description

Detects usage of cryptographically weak hash functions (specifically SHA-1) in Python code. SHA-1 is considered cryptographically broken and should not be used for security purposes as it is vulnerable to collision attacks, making it unsuitable for digital signatures or other security mechanisms.

Detection Strategy

• Identifies Python import statements or usage of SHA-1 hash functions from cryptographic libraries

• Detects direct usage of 'sha1' or 'SHA1' in function calls, object instantiation, or method invocations

• Reports vulnerabilities when SHA-1 is used in cryptographic operations or message digests

• Excludes cases where SHA-1 is used for non-security purposes like checksums with explicit comments

Vulnerable code example

import hashlib

# Vulnerable: Using SHA1 is cryptographically insecure due to collision attacks
hash_obj = hashlib.sha1()  
hash_obj.update(b"sensitive data")
hash_obj.digest()

# Vulnerable: Direct SHA1 usage with data...

✅ Secure code example

import hashlib

# Use SHA-256 instead of SHA-1 for cryptographic security
hash_obj = hashlib.sha256()  # SHA-256 is cryptographically secure
hash_obj.update(b"sensitive data")
hash_obj.digest()

# Use SHA-256 for direct hashing...