From bae3b41c799e81ec4361f3179bf7e5a5fcf631a5 Mon Sep 17 00:00:00 2001 From: Matt Edmondson Date: Mon, 24 Aug 2026 01:39:57 +1000 Subject: [PATCH] fix: suppress S4790 on the MD5 and SHA-1 hash providers [patch] SonarCloud rates new code on main D for security, on the strength of eight S4790 "use a stronger hashing algorithm" findings across these two providers. They are false positives by construction: a package named ktsu.Essentials.HashProviders.MD5 has to call MD5, and the algorithm is fixed by the type's contract rather than chosen per call. Suppress at class level, alongside the CA5351 and CA5350 suppressions already there for the same reason, and with justifications in the same shape. Class level is the smallest scope that covers it, since all four sites per file are the algorithm the type exists to expose. These findings predate the async stream work; they were raised 2026-08-13 and only started failing the gate once main's new code window moved. --- Essentials.HashProviders.MD5/MD5HashProvider.cs | 1 + Essentials.HashProviders.SHA1/SHA1HashProvider.cs | 1 + 2 files changed, 2 insertions(+) diff --git a/Essentials.HashProviders.MD5/MD5HashProvider.cs b/Essentials.HashProviders.MD5/MD5HashProvider.cs index 1e97ded..6ddd847 100644 --- a/Essentials.HashProviders.MD5/MD5HashProvider.cs +++ b/Essentials.HashProviders.MD5/MD5HashProvider.cs @@ -17,6 +17,7 @@ namespace ktsu.Essentials.HashProviders.MD5; /// registered as a singleton, concurrent callers corrupted each other's in-progress hash state. /// [SuppressMessage("Security", "CA5351:Do Not Use Broken Cryptographic Algorithms", Justification = "This provider exists specifically to implement MD5, which callers select deliberately for compatibility")] +[SuppressMessage("Security", "S4790:Using weak hashing algorithms is security-sensitive", Justification = "This provider exists specifically to implement MD5, which callers select deliberately for compatibility. The algorithm is fixed by the type's contract and cannot be substituted for a stronger one")] public class MD5HashProvider : IHashProvider { /// diff --git a/Essentials.HashProviders.SHA1/SHA1HashProvider.cs b/Essentials.HashProviders.SHA1/SHA1HashProvider.cs index db06815..51ff011 100644 --- a/Essentials.HashProviders.SHA1/SHA1HashProvider.cs +++ b/Essentials.HashProviders.SHA1/SHA1HashProvider.cs @@ -17,6 +17,7 @@ namespace ktsu.Essentials.HashProviders.SHA1; /// registered as a singleton, concurrent callers corrupted each other's in-progress hash state. /// [SuppressMessage("Security", "CA5350:Do Not Use Weak Cryptographic Algorithms", Justification = "This provider exists specifically to implement SHA-1, which callers select deliberately for compatibility")] +[SuppressMessage("Security", "S4790:Using weak hashing algorithms is security-sensitive", Justification = "This provider exists specifically to implement SHA-1, which callers select deliberately for compatibility. The algorithm is fixed by the type's contract and cannot be substituted for a stronger one")] public class SHA1HashProvider : IHashProvider { ///