Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=209.85.219.48; helo=mail-qv1-f48.google.com; envelope-from=matt@jellyfish.co; receiver=<UNKNOWN> 
MIME-Version: 1.0
References: <CADiSC1kuOSS=Kv2c4G3Zg+aeHcbCQ4C9CHSjfK1OGQLkMg-cqA@mail.gmail.com>
In-Reply-To: <CADiSC1kuOSS=Kv2c4G3Zg+aeHcbCQ4C9CHSjfK1OGQLkMg-cqA@mail.gmail.com>
From: Matt Klein <matt@jellyfish.co>
Date: Mon, 16 Oct 2023 12:43:17 -0400
Message-ID: <CADiSC1m=fMdCZOGeKrtWBi=MH0muckNkMh42DESJDtcewXACtw@mail.gmail.com>
Subject: Re: [PATCH django-impersonate] Specify usedforsecurity=False in call
 to hashlib.sha1 as a security best practice
To: ~petersanchez/public-inbox@lists.code.netlandish.com
Content-Type: text/plain; charset="UTF-8"

Our security audit tooling (bandit) flags that this call to
hashlib.sha1 should be marked with usedforsecurity=False (docs), since
it's being used in a non-security context (i.e., as a
non-cryptographic ID-generating function).

Doing so prevents this code from getting flagged in our toolchain, and
it seems to be best practice, so I'd suggest integrating this into the
main repo.

Thanks,
Matt Klein

--- a/vendor/django-impersonate-1.9.1/impersonate/signals.py
+++ b/vendor/django-impersonate-1.9.1/impersonate/signals.py
@@ -22,7 +22,7 @@ ID_LENGTH = 12
 def gen_unique_id():
     return hashlib.sha1(
-        u'{0}:{1}'.format(get_random_string(ID_LENGTH),
tz_now()).encode('utf-8')
+        u'{0}:{1}'.format(get_random_string(ID_LENGTH),
tz_now()).encode('utf-8'), usedforsecurity=False
     ).hexdigest()