Description

Detects usage of weak MD5 hashing algorithm in Ruby applications. MD5 is cryptographically broken and should not be used for securing sensitive information as it is vulnerable to collision attacks and can lead to compromised data security.

Detection Strategy

• Checks if the 'digest' or 'openssl' libraries are imported in the Ruby code

• Identifies direct usage of MD5 hashing through constant references (e.g., Digest::MD5, OpenSSL::Digest::MD5)

• Detects creation of new MD5 hash objects (e.g., Digest::MD5.new, OpenSSL::Digest.new('md5'))

• Reports a vulnerability when MD5 is used in any of these contexts

Vulnerable code example

require 'digest'

# MD5 is cryptographically broken and vulnerable to collisions
password = "super_secret"
md5_hash = Digest::MD5.hexdigest(password)  # Vulnerable: Using MD5 for password hashing

# Direct usage of MD5 digest is also insecure
token = "sensitive_data"...

✅ Secure code example

require 'digest'
require 'openssl'

# Use secure SHA-256 for password hashing (better to use bcrypt in production)
password = "super_secret"
sha256_hash = Digest::SHA256.hexdigest(password)  # Safe: Using SHA-256 instead of MD5

# Use SHA-512 for data integrity...