From 41e817a6a5c62e6aacbbddac87fc7645ef3b8251 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 09:12:51 +0000
Subject: [PATCH] fix: resolve CodeQL alert #21 - Use of a broken or weak
 cryptographic algorithm

---
 vulnerable_weak_crypto.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/vulnerable_weak_crypto.py b/vulnerable_weak_crypto.py
index 5b8aca6..3f85125 100644
--- a/vulnerable_weak_crypto.py
+++ b/vulnerable_weak_crypto.py
@@ -41,9 +41,12 @@ def verify_password(input_password, stored_hash):
     return input_hash == stored_hash
 
 def encrypt_sensitive_data(data):
-    key = b'weakkey1'
-    cipher = DES.new(key, DES.MODE_ECB)
-    return cipher.encrypt(data.encode().ljust(8))
+    from Crypto.Cipher import AES
+    from Crypto.Random import get_random_bytes
+    key = get_random_bytes(32)
+    cipher = AES.new(key, AES.MODE_GCM)
+    ciphertext, tag = cipher.encrypt_and_digest(data.encode())
+    return cipher.nonce + tag + ciphertext
 
 def generate_otp():
     return str(random.randrange(100000, 999999))