Subject: Re: [PATCH django-impersonate] Specify usedforsecurity=False in call to hashlib.sha1 as a security best practice

From: Matt Klein <[email-masked]>
Date: Mon, 16 Oct 2023 12:43:17 -0400

Our security audit tooling (bandit) flags that this call to
hashlib.sha1 should be marked with usedforsecurity=False (docs), since
it's being used in a non-security context (i.e., as a
non-cryptographic ID-generating function).

Doing so prevents this code from getting flagged in our toolchain, and
it seems to be best practice, so I'd suggest integrating this into the
main repo.

Thanks,
Matt Klein

--- a/vendor/django-impersonate-1.9.1/impersonate/signals.py
+++ b/vendor/django-impersonate-1.9.1/impersonate/signals.py
@@ -22,7 +22,7 @@ ID_LENGTH = 12
 def gen_unique_id():
     return hashlib.sha1(
-        u'{0}:{1}'.format(get_random_string(ID_LENGTH),
tz_now()).encode('utf-8')
+        u'{0}:{1}'.format(get_random_string(ID_LENGTH),
tz_now()).encode('utf-8'), usedforsecurity=False
     ).hexdigest()

---

From: Peter Sanchez <[email-masked]>
Date: Wed, 18 Oct 2023 13:57:45 -0600

>it seems to be best practice, so I'd suggest integrating this into the

Matt, thanks for the patch! The issue here is that the `usedforsecurty`
keyword variable was added in Python 3.9 and current supported versions
of Django are 3.2, 4.1 and 4.2.

Unfortunately 3.2 supports Python 3.6 still (though support for 3.2 goes
away in April next year) and 4.2 has support for 3.8 and is supported
until April 2026.

So I think the patch needs a Python version check and if it's 3.9+, add
the flag.