falconGitHub

avoid-weak-cryptographic-algorithms

Path
lint/security/avoid-weak-cryptographic-algorithms
Default
On (recommended)
Origin
Falcon
Rule
187 of 512
recommended

Flags references to MD5, SHA-1, DES, triple DES, and RC4 package APIs.

Weak hashes and ciphers cannot reliably protect sensitive data; use a modern algorithm instead. The rule recognizes md5 and sha1 from crypto, DES and DES3 from dart_des, and RC4 from simple_rc4, including through prefixed imports and re-exports. Unrelated APIs with the same spelling are not reported. Algorithm uses and constructor references are checked, but type annotations alone are not.

Invalid

example.dartdart
import 'package:crypto/crypto.dart';
import 'package:crypto/crypto.dart' as crypto;
import 'package:dart_des/dart_des.dart';
import 'package:dart_des/dart_des.dart' as des;
import 'package:simple_rc4/simple_rc4.dart';
import 'package:simple_rc4/simple_rc4.dart' as stream;

void weakAlgorithms(List<int> bytes) {
  final first = md5;
  final second = sha1;
  crypto.md5.convert(bytes);
  Hmac(crypto.sha1, bytes);
  DES(key: bytes);
  DES3(key: bytes);
  RC4('secret');
  new des.DES(key: bytes);
  new des.DES3(key: bytes);
  new stream.RC4.fromBytes(bytes);
  stream.RC4.fromBytes(bytes);
  final constructor = stream.RC4.new;
}
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
8void weakAlgorithms(List<int> bytes) {
9 final first = md5;
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
9 final first = md5;
10 final second = sha1;
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
10 final second = sha1;
11 crypto.md5.convert(bytes);
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
11 crypto.md5.convert(bytes);
12 Hmac(crypto.sha1, bytes);
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
12 Hmac(crypto.sha1, bytes);
13 DES(key: bytes);
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
13 DES(key: bytes);
14 DES3(key: bytes);
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
14 DES3(key: bytes);
15 RC4('secret');
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
15 RC4('secret');
16 new des.DES(key: bytes);
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
16 new des.DES(key: bytes);
17 new des.DES3(key: bytes);
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
17 new des.DES3(key: bytes);
18 new stream.RC4.fromBytes(bytes);
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
18 new stream.RC4.fromBytes(bytes);
19 stream.RC4.fromBytes(bytes);
Avoid weak cryptographic algorithms. Use a modern hash or cipher instead.
19 stream.RC4.fromBytes(bytes);
20 final constructor = stream.RC4.new;

Valid

example.dartdart
import 'package:crypto/crypto.dart';
import 'package:crypto/crypto.dart' as crypto;
import 'package:lookalike/lookalike.dart' as unrelated;

void strongAlgorithms(List<int> bytes) {
  final first = sha256;
  final second = crypto.sha512;
  Hmac(sha256, bytes);
  crypto.sha256.convert(bytes);
  final text = 'md5 sha1 DES DES3 RC4';
}

void shadowedHash(Object md5, Object sha1) {
  final first = md5;
  final second = sha1;
}

void shadowedPrefix(LocalHashes crypto) {
  final first = crypto.md5;
  final second = crypto.sha1;
}

class LocalHashes {
  final md5 = 1;
  final sha1 = 2;
  void useMembers() {
    final first = md5;
    final second = sha1;
  }
}

void unrelatedPackage() {
  final first = unrelated.md5;
  final second = unrelated.sha1;
  unrelated.DES();
  unrelated.DES3();
  unrelated.RC4();
}

Configure avoid-weak-cryptographic-algorithms

Set its severity in falcon.json. See the configuration guide.

falcon.jsonjson
{
  "linter": {
    "rules": {
      "security": {
        "avoid-weak-cryptographic-algorithms": "error"
      }
    }
  }
}

Or silence one occurrence with a suppression comment; the reason is required.

example.dartdart
// falcon-ignore lint/security/avoid-weak-cryptographic-algorithms: <reason>
  • prefer-random-secure

    Prefer the cryptographically secure dart:math random generator.

  • secure-pubspec-urlssecure_pubspec_urlsrecommendedcross-file

    Disallow insecure URL schemes in pubspec.yaml string values.

  • avoid-hardcoded-credentials

    Warns when credential-like variables, fields, or parameter defaults use nonempty string or numeric literals.

  • avoid-sensitive-query-params

    Detect explicit secret-bearing URL query keys, not arbitrary occurrences of words such as token in paths, fragments, map values, or prose.