security: replace md5() with sha256 for email dedup key (GHSA-gf2h-84m3-q6m3) - #809
security: replace md5() with sha256 for email dedup key (GHSA-gf2h-84m3-q6m3)#809bmfmancini wants to merge 3 commits into
Conversation
somethingwithproof
left a comment
somethingwithproof
left a comment
There was a problem hiding this comment.
The PHP change is safe for an in-process deduplication key, but this PR does not yet meet the repository's changed-line gate: the Pest job reports 0/1 changed lines covered, and every integration check is red. Please rebase onto the Cacti-Composer/Pest workflow from #776, add a focused Pest case that exercises recipient grouping/deduplication, and add the CHANGELOG entry. Also describe this accurately as static-analysis hardening: this value is not a cryptographic trust boundary.
|
I will add the changelogs but the tests I will be reorganizing like in 1.2.x branch so I don't want to push them until that pr is merged |
Replace md5() with hash('sha256', ...) for the email grouping
deduplication key. While this usage is not security-sensitive (it's
a cache key for grouping emails by recipient list, not password
hashing or integrity verification), using a modern hash algorithm
eliminates the weak hashing finding (CWE-1240).
Addresses SonarQube finding: php:S4790 at thold_functions.php:7311
c7b4a73 to
cafe52d
Compare
|
The latest revision now has a focused test, CHANGELOG entry, and green CI. The code change itself is safe, but this value is only an in-process array deduplication key, not a cryptographic trust boundary, so please keep the description framed as static-analysis hardening. Before merge, split out the unrelated shared workflow changes; they are duplicated across #806-#809 and remove the advisory develop compatibility job from every patch. |
Security Fix — GHSA-gf2h-84m3-q6m3
Fixes GHSA-gf2h-84m3-q6m3
Summary
The
thold_notification_queue_process()function inthold_functions.phpused PHP'smd5()function (line 7311) to generate a cache key for deduplicating queued email notifications by recipient list.Vulnerability Details
php:S4790(SonarQube)thold_functions.php, line 7311Changes
Replaced
md5()withhash('sha256', ...)which uses a modern, collision-resistant hash algorithm.Testing
php -l thold_functions.php)