Browse Source

Use a safer algorithm, and limit the size of the hashed string.

Fix an issue reported by Sonar.
pull/1149/head
Benoit Marty 1 year ago committed by Benoit Marty
parent
commit
64a7fc5f52
  1. 6
      features/ftue/impl/src/main/kotlin/io/element/android/features/ftue/impl/migration/SharedPrefsMigrationScreenStore.kt
  2. 6
      libraries/androidutils/src/main/kotlin/io/element/android/libraries/androidutils/hash/Hash.kt

6
features/ftue/impl/src/main/kotlin/io/element/android/features/ftue/impl/migration/SharedPrefsMigrationScreenStore.kt

@ -19,7 +19,7 @@ package io.element.android.features.ftue.impl.migration
import android.content.SharedPreferences import android.content.SharedPreferences
import androidx.core.content.edit import androidx.core.content.edit
import com.squareup.anvil.annotations.ContributesBinding import com.squareup.anvil.annotations.ContributesBinding
import io.element.android.libraries.androidutils.hash.md5 import io.element.android.libraries.androidutils.hash.hash
import io.element.android.libraries.di.AppScope import io.element.android.libraries.di.AppScope
import io.element.android.libraries.di.DefaultPreferences import io.element.android.libraries.di.DefaultPreferences
import io.element.android.libraries.matrix.api.core.SessionId import io.element.android.libraries.matrix.api.core.SessionId
@ -49,7 +49,9 @@ class SharedPrefsMigrationScreenStore @Inject constructor(
} }
private fun SessionId.toKey(): String { private fun SessionId.toKey(): String {
return IS_MIGRATION_SCREEN_SHOWN_PREFIX + value.md5() // Hash the sessionId to get ride of exotic char and take only the first 16 chars,
// The risk of collision is not high.
return IS_MIGRATION_SCREEN_SHOWN_PREFIX + value.hash().take(16)
} }
companion object { companion object {

6
libraries/androidutils/src/main/kotlin/io/element/android/libraries/androidutils/hash/Hash.kt

@ -20,10 +20,10 @@ import java.security.MessageDigest
import java.util.Locale import java.util.Locale
/** /**
* Compute a Hash of a String, using md5 algorithm. * Compute a Hash of a String, using SHA-512 algorithm.
*/ */
fun String.md5() = try { fun String.hash() = try {
val digest = MessageDigest.getInstance("md5") val digest = MessageDigest.getInstance("SHA-512")
digest.update(toByteArray()) digest.update(toByteArray())
digest.digest() digest.digest()
.joinToString("") { String.format(Locale.ROOT, "%02X", it) } .joinToString("") { String.format(Locale.ROOT, "%02X", it) }

Loading…
Cancel
Save