FIX: [CodeQL: SM02196] Weak cryptography in TrackingConfigHashAlgorithm.cs #5065
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
@microsoft-github-policy-service agree company="Microsoft" |
DergachevE
reviewed
Feb 4, 2025
…b.com/microsoft/azure-pipelines-agent into user/mdhingra/weakHash_trackingConfig updating branch
tarunramsinghani
approved these changes
Feb 12, 2025
| @@ -99,7 +103,14 @@ public void TrackingConfig_ctor_should_fill_in_fields_correctly() | |||
| Assert.Equal(DefinitionName, config.DefinitionName); | |||
| Assert.Equal(3, config.FileFormatVersion); | |||
| Assert.Equal(null, config.FileLocation); | |||
| Assert.Equal("ea7c71421cca06c927f73627b66d6b4f4c3a5f4a", config.HashKey); | |||
| if (useSha256) | |||
There was a problem hiding this comment.
How is this being tested for both configurations ? i.e. UseSha256InComputeHash is off and when it is on.
There was a problem hiding this comment.
The variable useSha256 will capture the value of knob, and then we compare with the respective hash value
|
|
||
| // Make sure that different coll creates different hash | ||
| Assert.Equal("2a41800cd3e7f5983a7643698f67104ed95101f3", TrackingConfigHashAlgorithm.ComputeHash("FFFA5D79-7735-49E3-87DA-02E76CF8D03A", definitionId, new[] { repo1 })); |
There was a problem hiding this comment.
Can we keep old ones as well instead of replacing.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
In TrackingConfigHashAlgorithm.cs, SHA1 was being used to compute the hashKey, which is used to identify the tracking config file in the agent system and hence the workspace identifier.
Change Description
The PR addresses the CodeQL warning of using a weak hash algortihm by replacing it with SHA256 based on the recommendations - SM02196
Also it updates the existing Unit Tests with the updated hash values from the new algorithm.
The PR also introduces a new dynamic Feature Flag (UseSha256InComputeHash) in case we want to rollback.
Validations