Weak Cryptography alert in SonarQube for SHA256

[chilakala (Goutham kumar)]

Template for a good bug report, formatted with Markdown:

• versions used : SonarQube Community Edition Version 8.9.1 (build 44547)

• error observed : We have analyzed our JS code in SonarQube. After analysis, sonarqube is flagging for medium hotspot alert for new SHA256(secret)). Not sure why we are getting alert for this.

export const cryptography = { hash: (text: string) => { const hash = createHash('sha256'); hash.update(text); return hash.digest('hex'); },

• potential workaround
  I see a GitHub issue present for this and its closed now
  It mentions that it has been fixed in newer version of SonarQube. We are using the latest LTS 8.9.1, not sure why we are getting this flagged.

Rule S4790: its content should be replaced by S2070

[chilakala (Goutham kumar)]

@eric.therond I did see another post you have replied earlier. Could you please help.

Need help for Weak Cryptography alert in SonarQube for SHA256

Must-share information (formatted with Markdown): which versions are you using- 8.6 We have analyze our project in SonarQube. After analysis, sonarqube is flagging for medium hotspot alert for new HMACSHA256(secret)). Not sure why we are getting alert for this. var secret = Encoding.UTF8.GetBytes(fmsSecret); using (var hasher = new HMACSHA256(secret)) As per recommendation, SHA256 are safer alternative. Not sure why this is being highlighted and how to fix it. Reg…

[ganncamp (G Ann Campbell)]

Hi,

Welcome to the community!

Please don’t invoke (@) people who aren’t already involved in your thread.

Regarding your question:

@chilakala

hotspot alert for new SHA256(secret)). Not sure why we are getting alert for this.

Did you read the accompanying documentation in the interface?

 
Ann