ESLint Rule to discourage hashes being created with unsafe algorithms #190973
Conversation
| schema: [], | ||
| }, | ||
| create(context) { | ||
| const allowedAlgorithms = ['sha1', 'sha256']; |
There was a problem hiding this comment.
A list of allowed algorithms to be used with crypto.createHash
|
@elasticmachine merge upstream |
| schema: [], | ||
| }, | ||
| create(context) { | ||
| const allowedAlgorithms = ['sha1', 'sha256', 'sha3-256']; |
There was a problem hiding this comment.
Seems like we may want to avoid sha1 if we can?
https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm
There was a problem hiding this comment.
Nice, thanks! Addressed in 79678e8
|
Is this pinging response-ops because there is a |
@jcger That's probably it. Not sure where the automation picked up response-ops from. Sorry for the noise! |
|
@elasticmachine merge upstream |
|
@elastic/security-scalability Hi team! We need your review on this PR. I think you were added as a result of a bad merge with main somewhere, so I don't think there are any files owned by you. But just in case, please review and approve when possible. |
| @@ -4,7 +4,7 @@ | |||
| * 2.0; you may not use this file except in compliance with the Elastic License | |||
| * 2.0. | |||
| */ | |||
| /* eslint-disable @typescript-eslint/no-explicit-any */ | |||
|
|
|||
There was a problem hiding this comment.
This file is indeed owned by @elastic/security-scalability .
Unfortunately, it makes no sense to accept your suggestion as this rules has been disabled for a reason. We get three warnings if we disable the rule for this file:
Let's revert this:
| /* eslint-disable @typescript-eslint/no-explicit-any */ |
|
@elasticmachine merge upstream |
|
@elasticmachine merge upstream |
|
@elasticmachine merge upstream |
💛 Build succeeded, but was flaky
Failed CI StepsMetrics [docs]Unknown metric groupsESLint disabled line counts
Total ESLint disabled count
History
To update your PR or re-run it, just comment with: |
Closes #185601
Summary
Using non-compliant algorithms with Node Cryptos createHash function will cause failures when running Kibana in FIPS mode.
We want to discourage usages of such algorithms.