Skip to content

[Security] Fix CodeQL alert #19: Use of a broken or weak cryptographic algorithm #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
colin-d-fried wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Security] Fix CodeQL alert #19: Use of a broken or weak cryptographic algorithm #93

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions vulnerable_weak_crypto.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,10 @@ def hash_with_sha1(data):
return hashlib.sha1(data.encode()).hexdigest()

def encrypt_data_des(data, key):
cipher = DES.new(key, DES.MODE_ECB)
encrypted = cipher.encrypt(data)
return encrypted
from Crypto.Cipher import AES
cipher = AES.new(key, AES.MODE_GCM)
ciphertext, tag = cipher.encrypt_and_digest(data)
return cipher.nonce + tag + ciphertext

@cursor cursor Bot Mar 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Function name misleadingly references DES despite using AES

Medium Severity

The function encrypt_data_des was changed to use AES.MODE_GCM internally, but the function name still says "des." This creates a misleading API contract — callers expect DES (8-byte key) but get AES (16/24/32-byte key), so any existing caller passing a DES-sized key will receive a runtime error. The return format also changed from raw ciphertext to nonce + tag + ciphertext with no update to the function name or signature to signal these breaking changes.

Fix in Cursor Fix in Web


def encrypt_with_arc2(plaintext, key):
cipher = ARC2.new(key, ARC2.MODE_ECB)
Expand Down
Loading