Colly has vulnerabilities with medium criticality

[m-carneiro]

CWE-916: Use of Password Hash With Insufficient Computational Effort

On http_backend.go:136

The sha1 hash function is no longer considered secure for cryptographic purposes, as it is vulnerable to attacks such as length extension and collision. To make your hashing more secure, I recommend using a more secure hash function like SHA-256, which is a part of the SHA-2 family, or SHA-3. Here's an example of how to use SHA-256 in Go:

    hasher := sha256.New()
    hasher.Write([]byte(url))
    sum := hasher.Sum(nil)

On instagram.go:99

MD5 is an outdated and insecure cryptographic hash function that is not recommended for security-sensitive applications. To make your hashing more secure, you can use a modern hash function like SHA-256, which is part of the SHA-2 family, or SHA-3. Here's an example of how to use SHA-256 in Go:

    hasher := sha256.New()
    hasher.Write(data)
    sum := hasher.Sum(nil)

Tried to do a pull request but 403.

mtscrnr

[WGH-]

On http_backend.go:136

This indeed might me improved.

On instagram.go:99

This code replicates Instagram algorithm that "authenticates" requests. (though the code is likely outdated, and I doubt it works as is since antibot protection has been likely improved since)

Tried to do a pull request but 403.

What do you mean?

[m-carneiro]

What do you mean?

Permission denied.

> git push -u origin remediating_hashing_vulns
remote: Permission to gocolly/colly.git denied to m-carneiro.
fatal: unable to access 'https://github.com/gocolly/colly.git/': The requested URL returned error: 403

[WGH-]

Permission denied.

> git push -u origin remediating_hashing_vulns
remote: Permission to gocolly/colly.git denied to m-carneiro.
fatal: unable to access 'https://github.com/gocolly/colly.git/': The requested URL returned error: 403

In order to contribute, you have to create a fork, push your changes there, and submit a pull request. See https://docs.github.com/en/get-started/quickstart/contributing-to-projects

[Delicious-Bacon]

Could you also check the net package while at it? It's "high severity".

Dependency
golang.org/x/net

Version
< 0.7.0

Upgrade to
~> 0.7.0