Add comments to supress CodeQL alerts (Azure#13332)

* Add CodeQL compatibility comments for legacy hash usage

Added comments referencing CodeQL [SM02167] and [SM04388] to clarify the use of legacy hash algorithms (e.g., md5, sha1, SHA1) and certain cryptographic imports for backward compatibility and non-security purposes.

Author: rahul0216

Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeFalconAdversaryIntelligence/CrowdStrikeFalconThreatIntelConnector/__init__.py

@@ -166,7 +166,7 @@ def generate_uuid(identifier: str):
         uuid.UUID: Generated UUID object based on the identifier hash
     """
 
-    hash_value = hashlib.md5(identifier.encode())
+    hash_value = hashlib.md5(identifier.encode())            # CodeQL [SM02167] This is only being used to generate a UUID, not for security purposes.
     return uuid.UUID(hash_value.hexdigest())
 
 

Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/azure/functions/_thirdparty/werkzeug/http.py

@@ -21,7 +21,7 @@
 import warnings
 from datetime import datetime
 from datetime import timedelta
-from hashlib import md5
+from hashlib import md5             # CodeQL [SM02167] This is for backwards compatibility.
 from time import gmtime
 from time import time
 

Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/azure/identity/_credentials/certificate.py

@@ -94,7 +94,7 @@ def extract_cert_chain(pem_bytes: bytes) -> bytes:
 def load_pem_certificate(certificate_data: bytes, password: Optional[bytes] = None) -> _Cert:
     private_key = serialization.load_pem_private_key(certificate_data, password, backend=default_backend())
     cert = x509.load_pem_x509_certificate(certificate_data, default_backend())
-    fingerprint = cert.fingerprint(hashes.SHA1())  # nosec
+    fingerprint = cert.fingerprint(hashes.SHA1())  # nosec          # CodeQL [SM02167] This is for backward compatibility.
     return _Cert(certificate_data, private_key, fingerprint)
 
 

Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/azure/identity/_internal/aadclient_certificate.py

@@ -25,7 +25,7 @@ def __init__(self, pem_bytes: bytes, password: Optional[bytes] = None) -> None:
         self._private_key = private_key
 
         cert = x509.load_pem_x509_certificate(pem_bytes, default_backend())
-        fingerprint = cert.fingerprint(hashes.SHA1())  # nosec
+        fingerprint = cert.fingerprint(hashes.SHA1())  # nosec      # CodeQL [SM02167] This is for backward compatibility.
         self._thumbprint = base64.urlsafe_b64encode(fingerprint).decode("utf-8")
 
     @property

Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/azure/storage/blob/_encryption.py

@@ -19,7 +19,7 @@
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.ciphers import Cipher
-from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM              # CodeQL [SM04388] This is for backward code compatibility.
 from cryptography.hazmat.primitives.ciphers.algorithms import AES
 from cryptography.hazmat.primitives.ciphers.modes import CBC
 from cryptography.hazmat.primitives.padding import PKCS7

Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/azure/storage/blob/_shared/policies.py

@@ -352,7 +352,7 @@ def get_content_md5(data):
         # Since HTTP does not differentiate between no content and empty content,
         # we have to perform a None check.
         data = data or b""
-        md5 = hashlib.md5() # nosec
+        md5 = hashlib.md5() # nosec     # CodeQL [SM02167] This is for backwards compatibility.
         if isinstance(data, bytes):
             md5.update(data)
         elif hasattr(data, 'read'):

Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/cryptography/hazmat/_oid.py

@@ -142,7 +142,7 @@ class SignatureAlgorithmOID:
     SignatureAlgorithmOID.ECDSA_WITH_SHA3_224: hashes.SHA3_224(),
     SignatureAlgorithmOID.ECDSA_WITH_SHA3_256: hashes.SHA3_256(),
     SignatureAlgorithmOID.ECDSA_WITH_SHA3_384: hashes.SHA3_384(),
-    SignatureAlgorithmOID.ECDSA_WITH_SHA3_512: hashes.SHA3_512(),
+    SignatureAlgorithmOID.ECDSA_WITH_SHA3_512: hashes.SHA3_512(),       # CodeQL [SM02167] This is for compatibility.
     SignatureAlgorithmOID.DSA_WITH_SHA1: hashes.SHA1(),
     SignatureAlgorithmOID.DSA_WITH_SHA224: hashes.SHA224(),
     SignatureAlgorithmOID.DSA_WITH_SHA256: hashes.SHA256(),

Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/cryptography/hazmat/backends/openssl/backend.py

@@ -103,7 +103,7 @@ class Backend:
         hashes.SHA512,
         hashes.SHA512_224,
         hashes.SHA512_256,
-        hashes.SHA3_224,
+        hashes.SHA3_224,        # CodeQL [SM02167] This is for backwards compatibility.
         hashes.SHA3_256,
         hashes.SHA3_384,
         hashes.SHA3_512,

Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/cryptography/hazmat/primitives/serialization/pkcs7.py

@@ -24,7 +24,7 @@
 serialize_certificates = rust_pkcs7.serialize_certificates
 
 PKCS7HashTypes = typing.Union[
-    hashes.SHA224,
+    hashes.SHA224,              # CodeQL [SM02167] This is for compatibility.
     hashes.SHA256,
     hashes.SHA384,
     hashes.SHA512,

Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/cryptography/hazmat/primitives/serialization/ssh.py

@@ -914,7 +914,7 @@ def verify_cert_signature(self) -> None:
         else:
             assert isinstance(signature_key, rsa.RSAPublicKey)
             if self._inner_sig_type == _SSH_RSA:
-                hash_alg = hashes.SHA1()
+                hash_alg = hashes.SHA1()                    # CodeQL [SM02167] This is for backward compatibility.
             elif self._inner_sig_type == _SSH_RSA_SHA256:
                 hash_alg = hashes.SHA256()
             else: