Skip to content

[GFX-200] feature/GFX-200 #107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AlianBlank wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[GFX-200] feature/GFX-200 #107

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions GameFrameX.Foundation.Hash/Md5Helper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
// Official Documentation: https://gameframex.doc.alianblank.com/
// ==========================================================================================

using System.Diagnostics.CodeAnalysis;
using System.Security.Cryptography;
using System.Text;

Expand Down Expand Up @@ -130,6 +131,7 @@ public static string HashWithSalt(string input, byte[] salt, bool isUpper = fals
/// <param name="isUpper">是否返回大写形式的哈希值，默认为false返回小写 / Whether to return uppercase hash, defaults to false for lowercase</param>
/// <returns>32个字符的十六进制字符串形式的哈希值 / A 32-character hexadecimal string hash value</returns>
/// <exception cref="ArgumentNullException">当 <paramref name="input"/> 为 null 时抛出 / Thrown when <paramref name="input"/> is null</exception>
[SuppressMessage("Sonar Code Smell", "S4790:Use a stronger hashing algorithm", Justification = "MD5 is intentionally used here for non-cryptographic checksum / fingerprint / cache-key scenarios; for security-sensitive use cases call Sha256Helper instead.")]
public static string Hash(byte[] input, bool isUpper = false)
Comment on lines +134 to 135

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

请明确限制该公开 API 的使用场景。

SuppressMessage 会让整个公开的 Hash(byte[]) 实现不再触发 S4790，但当前 XML 文档没有说明该方法仅适用于校验、指纹或缓存键生成。这样可能掩盖密码存储、签名或安全完整性校验等不安全调用。请在该方法文档中明确禁止安全敏感用途，或提供命名更明确的非加密哈希 API；README.md 已说明这些场景应使用更强算法。

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@GameFrameX.Foundation.Hash/Md5Helper.cs` around lines 134 - 135, Update the
XML documentation for the public Hash(byte[] input, bool isUpper = false) method
in Md5Helper to explicitly restrict it to non-cryptographic checksums,
fingerprints, and cache keys, and explicitly prohibit password storage,
signatures, and security-sensitive integrity validation. Keep the existing
Sha256Helper guidance and SuppressMessage unchanged.

{
ArgumentNullException.ThrowIfNull(input, nameof(input));
Expand Down