
    >/i                         S r SSKrSSKJr  SSKJr  SrSrS rS r	\R                  " S	5      \R                  " S
5      S 5       5       rg)a  
======================================================================
B324: Test use of insecure md4, md5, or sha1 hash functions in hashlib
======================================================================

This plugin checks for the usage of the insecure MD4, MD5, or SHA1 hash
functions in ``hashlib`` and ``crypt``. The ``hashlib.new`` function provides
the ability to construct a new hashing object using the named algorithm. This
can be used to create insecure hash functions like MD4 and MD5 if they are
passed as algorithm names to this function.

This check does additional checking for usage of keyword usedforsecurity on all
function variations of hashlib.

Similar to ``hashlib``, this plugin also checks for usage of one of the
``crypt`` module's weak hashes. ``crypt`` also permits MD5 among other weak
hash variants.

:Example:

.. code-block:: none

    >> Issue: [B324:hashlib] Use of weak MD4, MD5, or SHA1 hash for
       security. Consider usedforsecurity=False
       Severity: High   Confidence: High
       CWE: CWE-327 (https://cwe.mitre.org/data/definitions/327.html)
       Location: examples/hashlib_new_insecure_functions.py:3:0
       More Info: https://bandit.readthedocs.io/en/latest/plugins/b324_hashlib.html
    2
    3   hashlib.new('md5')
    4

.. seealso::

 - https://cwe.mitre.org/data/definitions/327.html

.. versionadded:: 1.5.0

.. versionchanged:: 1.7.3
    CWE information added

.. versionchanged:: 1.7.6
    Added check for the crypt module weak hashes

    N)issue)test_properties)md4md5shasha1)METHOD_CRYPT
METHOD_MD5METHOD_BLOWFISHc                    U R                   nU[        ;   a  UR                  SS5      S:X  ar  [        R                  " [        R
                  [        R
                  [        R                  R                  SUR                  5        S3U R                  R                  S9$ g US:X  a  U R                  nU(       a  US   OUR                  SS 5      n[        U[        5      (       a  UR                  5       [        ;   a  UR                  SS5      S:X  ar  [        R                  " [        R
                  [        R
                  [        R                  R                  SUR                  5        S3U R                  R                  S9$ g g g g )	NusedforsecurityTruezUse of weak z2 hash for security. Consider usedforsecurity=Falseseverity
confidencecwetextlinenonewr   name)call_keywordsWEAK_HASHESgetbanditIssueHIGHr   CweBROKEN_CRYPTOuppernoder   	call_args
isinstancestrlower)contextfunckeywordsargsr   s        c/home/james-whalen/.local/lib/python3.13/site-packages/bandit/plugins/hashlib_insecure_functions.py_hashlib_funcr*   8   s<   $$H{<<)62f<<<!;;II++#DJJL> 21 1||**  = 
  tAwHLL$>dC  TZZ\[%@||-v6&@||#[[%{{		//'

~ 6? ?"<<..  A &A  
    c                     U R                   nU R                  nUS:X  a  [        U5      S:  a  US   OUR                  SS 5      n[	        U[
        5      (       a}  U[        ;   ar  [        R                  " [        R                  [        R                  [        R                  R                  SUR                  5        S3U R                  R                   S9$ g g US:X  a  U(       a  US   OUR                  S	S 5      n[	        U[
        5      (       a}  U[        ;   ar  [        R                  " [        R                  [        R                  [        R                  R                  SUR                  5        S3U R                  R                   S9$ g g g )
Ncrypt   saltzUse of insecure crypt.z hash function.r   mksaltr   method)r!   r   lenr   r"   r#   WEAK_CRYPT_HASHESr   r   MEDIUMr   r   r   r   r   r    r   )r%   r&   r(   r'   r   s        r)   _crypt_cryptr5   T   s6   D$$Hwd)a-tAwX\\&$-GdC  T->%><<!;;II++-djjl^?K||**  &?  
	tAwHLL4$@dC  T->%><<!;;II++-djjl^?K||**  &?  
r+   B324Callc                     [        U R                  [        5      (       aJ  U R                  R                  S5      nUS   nSU;   a  [	        X5      $ SU;   a  US;   a  [        X5      $ g g g )N.hashlibr-   )r-   r0   )r"   call_function_name_qualr#   splitr*   r5   )r%   qualname_listr&   s      r)   r;   r;   n   ss     '1137777==cBR % //%$2E*E.. +F% 8r+   )__doc__r   bandit.corer   r   testr   r3   r*   r5   test_idchecksr;    r+   r)   <module>rE      sY   ,Z   /+E 84 fV	/  	/r+   