Skip to content

Fix false positive with usedforsecurity flag in hashlib.sha1 (python)#3776

Open
resimon wants to merge 1 commit intosemgrep:developfrom
resimon:fix-usedforsecurity-hashlib-sha1
Open

Fix false positive with usedforsecurity flag in hashlib.sha1 (python)#3776
resimon wants to merge 1 commit intosemgrep:developfrom
resimon:fix-usedforsecurity-hashlib-sha1

Conversation

@resimon
Copy link
Copy Markdown

@resimon resimon commented Mar 25, 2026

Hello together,

similar to #3077

I want to propose that usedforsecurity is also considered as false positive for hashlib.sha1 in the python rules

So that

# ruleid:insecure-hash-algorithm-sha1
hashlib.sha1(1)

# ok:insecure-hash-algorithm-sha1
hashlib.sha1(1,usedforsecurity=False)

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Mar 25, 2026

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants