Skip to content

🧩 Knip uses unsafe hashing algorithm for CodeClimate fingerprint #1688

@remcohaszing

Description

@remcohaszing

Discuss anything related to Knip

Knip uses md5 to calculate the fingerprint of CodeClimate issues. Due to the nature of how this is used, the use of an insecure algorithm does not pose a security risk. However, in a FIPS compliant environment Node.js blocks the use of such hashing algorithms.

Changing the fingerprint formula is a breaking change. I suggest to replace it with a more secure algoritm, such as sha256, in the next major version.

See also remcohaszing/eslint-formatter-codeclimate#1

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions