From 2206368a5f716f3ce4323051058fc26de34f1062 Mon Sep 17 00:00:00 2001 From: Keith Tucker Date: Fri, 10 May 2024 12:02:42 -0400 Subject: [PATCH 1/2] Update utils.py Add usedforsecurity parameter to allow md5 use on systems enforcing compliance with Federal Information Processing Standards (FIPS). --- src/webassets/utils.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/webassets/utils.py b/src/webassets/utils.py index 985f5cec..697e11ee 100644 --- a/src/webassets/utils.py +++ b/src/webassets/utils.py @@ -16,7 +16,8 @@ if sys.version_info >= (2, 5): import hashlib - md5_constructor = hashlib.md5 + from functools import partial + md5_constructor = partial(hashlib.md5, usedforsecurity=False) else: import md5 md5_constructor = md5.new From 7584575be146546edc311fcbd44aa8086d927442 Mon Sep 17 00:00:00 2001 From: Keith Tucker Date: Fri, 21 Jun 2024 13:31:56 -0400 Subject: [PATCH 2/2] Support use on systems enforcing FIPS compliance. The Federal Information Processing Standards (FIPS) do not allow using the md5 algorithm for encryption since it is considered too weak. The hashlib implementation of md5 provided a workaround permitting continued use of the fast md5 algorithm by explicitly noting the use was not for security purposes. The changes here try using that workaround, and fall back to failing on systems enforcing FIPS. --- .vscode/settings.json | 4 ++++ src/webassets/utils.py | 11 +++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) create mode 100644 .vscode/settings.json diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 00000000..e137fadb --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,4 @@ +{ + "python.testing.unittestEnabled": false, + "python.testing.pytestEnabled": true +} \ No newline at end of file diff --git a/src/webassets/utils.py b/src/webassets/utils.py index 697e11ee..4d53b829 100644 --- a/src/webassets/utils.py +++ b/src/webassets/utils.py @@ -16,8 +16,15 @@ if sys.version_info >= (2, 5): import hashlib - from functools import partial - md5_constructor = partial(hashlib.md5, usedforsecurity=False) + try: + from functools import partial + # Include the usedforsecurity parameter so the call will + # succeed on systems that enforce compliance with the + # Federal Information Processing Standard (FIPS) and thus + # don't allow md5 for encryption. + md5_constructor = partial(hashlib.md5,usedforsecurity=False) + except (ImportError,TypeError): + md5_constructor = hashlib.md5 else: import md5 md5_constructor = md5.new