FIX: [CodeQL: SM02196] Weak cryptography in TrackingConfigHashAlgorithm.cs #5065
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
@microsoft-github-policy-service agree company="Microsoft" |
| } | ||
| else | ||
| { | ||
| using (SHA1 SHA1 = SHA1.Create()) |
There was a problem hiding this comment.
Just realized if we have this code still here, the CODE QL warning will still be present. will need to take exception for this to resolve the CODQL warning.
DergachevE
reviewed
Feb 4, 2025
| new PipelineFeatureSource("UseSha256InComputeHash"), | ||
| new RuntimeKnobSource("AGENT_USE_SHA256_IN_COMPUTE_HASH"), | ||
| new EnvironmentKnobSource("AGENT_USE_SHA256_IN_COMPUTE_HASH"), | ||
| new BuiltInDefaultKnobSource("true")); |
There was a problem hiding this comment.
Is it safe to have it true by default?
| hexString.Append(data[i].ToString("x2")); | ||
| } | ||
| byte[] data = sha256Hash.ComputeHash(Encoding.UTF8.GetBytes(hashInput)); | ||
| StringBuilder hexString = new StringBuilder(); |
| using (SHA1 SHA1 = SHA1.Create()) | ||
| { | ||
| byte[] data = SHA1.ComputeHash(Encoding.UTF8.GetBytes(hashInput)); | ||
| StringBuilder hexString = new StringBuilder(); |
| hexString.Append(data[i].ToString("x2")); | ||
| } | ||
| byte[] data = sha256Hash.ComputeHash(Encoding.UTF8.GetBytes(hashInput)); | ||
| StringBuilder hexString = new StringBuilder(); |
There was a problem hiding this comment.
This part is identical to the same in else
The only difference I see is how data is filled based on hash function used
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
In TrackingConfigHashAlgorithm.cs, SHA1 was being used to compute the hashKey, which is used to identify the tracking config file in the agent system and hence the workspace identifier.
Change Description
The PR addresses the CodeQL warning of using a weak hash algortihm by replacing it with SHA256 based on the recommendations - SM02196
Also it updates the existing Unit Tests with the updated hash values from the new algorithm.
The PR also introduces a new dynamic Feature Flag (UseSha256InComputeHash) in case we want to rollback.
Validations