set line length to 120 #1735
set line length to 120 #1735
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -173,7 +183,9 @@ | |||
| if security_policy.host_certificate: | |||
| chunk.SecurityHeader.SenderCertificate = security_policy.host_certificate | |||
| if security_policy.peer_certificate: | |||
| chunk.SecurityHeader.ReceiverCertificateThumbPrint = hashlib.sha1(security_policy.peer_certificate).digest() | |||
| chunk.SecurityHeader.ReceiverCertificateThumbPrint = hashlib.sha1( | |||
| security_policy.peer_certificate | |||
Check failure
Code scanning / CodeQL
Use of a broken or weak cryptographic hashing algorithm on sensitive data High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 29 days ago
To fix the problem, we need to replace the use of the SHA-1 hashing algorithm with a stronger algorithm, such as SHA-256. This change will ensure that the certificate's hash is more secure against collision attacks.
- General Fix: Replace the
hashlib.sha1function withhashlib.sha256. - Detailed Fix: Specifically, change the line where
hashlib.sha1is used tohashlib.sha256in themessage_to_chunksmethod. - Files/Regions/Lines to Change: The change will be made in the file
asyncua/common/connection.pyon line 187. - Requirements: Ensure that the
hashlibmodule is imported (already present in the code).
| @@ -185,3 +185,3 @@ | ||
| if security_policy.peer_certificate: | ||
| chunk.SecurityHeader.ReceiverCertificateThumbPrint = hashlib.sha1( | ||
| chunk.SecurityHeader.ReceiverCertificateThumbPrint = hashlib.sha256( | ||
| security_policy.peer_certificate |
oroulet
force-pushed
the
3.13
branch
2 times, most recently
from
cec8ec7
to
139a04f
Compare
| @@ -31,6 +31,7 @@ jobs: | |||
| uv tool install pre-commit | |||
| - name: Lint with ruff | |||
| run: | | |||
| uvx ruff format --diff | |||
There was a problem hiding this comment.
It might be better to include formatting in pre-commit, so it would also run it locally when comitting which is more convenient see https://github.com/astral-sh/ruff-pre-commit?tab=readme-ov-file#using-ruff-with-pre-commit
There was a problem hiding this comment.
I have 0 ideas how to add that to pre-commit. So you can do it.
But I feel it is a bit strange to use pre-commit to do linting. Isnt't much clearer to have the check we do in plain test here?
No description provided.