Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use newer algorithm for name generation #1155

Closed
BernieWhite opened this issue Jul 6, 2022 · 0 comments · Fixed by #1575
Closed

Use newer algorithm for name generation #1155

BernieWhite opened this issue Jul 6, 2022 · 0 comments · Fixed by #1575
Assignees
Labels
breaking-change Changes that affect existing functionality enhancement New feature or request
Milestone

Comments

@BernieWhite
Copy link
Member

Currently a SHA1 hash is used for name generation as a stable fallback if TargetName cannot be bound.

While not specifically used in a security context we should look at replacing this with a newer algorithm or an alternative as SHA1 is generally not recommended.

This may break suppressions because suppression is often done by name.

Also is overkill and could be confusing to have a name as long as a SHA512 so we should truncate the name, or provide some option for configuration related to the number of characters used for name generation.

In lead up to this breaking change we could provide the algorithm as a choice to allow configuration.

public HashAlgorithm ObjectHashAlgorithm
{
get
{
if (_Hash == null)
_Hash = new SHA1Managed();
return _Hash;
}
}

@BernieWhite BernieWhite added enhancement New feature or request breaking-change Changes that affect existing functionality labels Jul 6, 2022
@BernieWhite BernieWhite added this to the v3.0.0 milestone Jul 6, 2022
@BernieWhite BernieWhite self-assigned this Jul 16, 2023
BernieWhite added a commit to BernieWhite/PSRule that referenced this issue Jul 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
breaking-change Changes that affect existing functionality enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant