Use a constant for weak hashes
Small change to have a variable that has the set of weak hashes.
@@ -46,6 +46,9 @@ from bandit.core import issue
from bandit.core import test_properties as test
+WEAK_HASHES = ("md4", "md5", "sha", "sha1")
+
+
def _hashlib_func(context):
if isinstance(context.call_function_name_qual, str):
qualname_list = context.call_function_name_qual.split(".")
@@ -54,7 +57,7 @@ def _hashlib_func(context):
func = qualname_list[-1]
keywords = context.call_keywords
- if func in ("md4", "md5", "sha", "sha1"):
+ if func in WEAK_HASHES:
if keywords.get("usedforsecurity", "True") == "True":
return bandit.Issue(
severity=bandit.HIGH,
@@ -67,12 +70,7 @@ def _hashlib_func(context):
elif func == "new":
args = context.call_args
name = args[0] if args else keywords.get("name", None)
- if isinstance(name, str) and name.lower() in (
- "md4",
- "md5",
- "sha",
- "sha1",
- ):
+ if isinstance(name, str) and name.lower() in WEAK_HASHES:
if keywords.get("usedforsecurity", "True") == "True":
return bandit.Issue(
severity=bandit.HIGH,
@@ -93,12 +91,7 @@ def _hashlib_new(context):
args = context.call_args
keywords = context.call_keywords
name = args[0] if args else keywords.get("name", None)
- if isinstance(name, str) and name.lower() in (
- "md4",
- "md5",
- "sha",
- "sha1",
- ):
+ if isinstance(name, str) and name.lower() in WEAK_HASHES:
return bandit.Issue(
severity=bandit.MEDIUM,
confidence=bandit.HIGH,
