Description

Detects usage of the SHA-1 hashing algorithm in Swift applications through CryptoKit or CommonCrypto libraries. SHA-1 is cryptographically broken and can lead to hash collisions, making it unsuitable for security-sensitive operations like password hashing or digital signatures.

Detection Strategy

• Application code imports CryptoKit or CommonCrypto libraries

• Code contains calls to SHA-1 hashing functions or methods

• The SHA-1 hash operation is used with security-sensitive data

• Reports a vulnerability when SHA-1 is used in security contexts rather than legacy compatibility

Vulnerable code example

import CryptoKit
import CommonCrypto

func hashPassword(password: String) {
    let data = password.data(using: .utf8)!
    
    // VULNERABLE: Using cryptographically broken SHA1 hash
    let sha1Hash = Insecure.SHA1.hash(data: data)...

✅ Secure code example

import CryptoKit
import Foundation

func hashPassword(password: String) -> String? {
    guard let data = password.data(using: .utf8) else {
        return nil
    }
    ...