[GROOVY-11459] weak hashing algorithm (使用弱哈希算法)

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.0.22
• Fix Version/s: 5.0.0-alpha-11, 4.0.24

Language

groovy

• Assignee: Paul King
• Reporter: wellchang
• Created: 03/Sep/24 04:12
• Updated: 12/Nov/24 11:39
• Resolved: 04/Nov/24 12:10

Description

通过iast扫描发现groovy中使用了md5来生成缓存键名，路径为groovy.lang.GroovyClassLoader.getSourceCacheKey

建议使用常见的安全的哈希算法，如SHA-256,SHA-384,SHA-512等

Google Translate gives:
Through iast scanning, it was found that md5 is used in groovy to generate the cache key name, and the path is groovy.lang.GroovyClassLoader.getSourceCacheKey

It is recommended to use common secure hash algorithms, such as SHA-256, SHA-384, SHA-512, etc.

Issue Links

• is cloned by: GROOVY-11515 configurable hashing algorithm
• links to: GitHub Pull Request #2112