gulpjs / v8flags

Get available v8 and Node.js flags.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Consider using SHA-256 over MD5 for the config file

silverwind opened this issue · comments

https://github.com/gulpjs/v8flags/blob/master/index.js#L19 contains a MD5 usage. When Node.js is built with FIPS compliance, that line triggers below error because MD5 is disabled in those builds:

Error: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips
    at new Hash (internal/crypto/hash.js:48:19)
    at Object.createHash (crypto.js:109:10)
    at Object.<anonymous> (node_modules/v8flags/index.js:19:89)

Consider using something more collision-resistant like SHA-256 instead.

@silverwind I'm down for that. I also assume our cacheing is fragile here because we are supposed to continue even if a cache error occurs, but that's a different problem.

It should be a simple swap of createHash('md5') to createHash('sha256'). SHA-256 hashes are a bit longer but you could just trim it down to the same size of MD5 if necessary using .substring(0,32) or similar.

This seems like a reasonable request - want to send a PR @silverwind ? Should be non-breaking.

Bump, I could really use this fix in a project. It is breaking the project when enforcing FIPS when enforcing FIPS because MD5 is not FIPS compliant @silverwind @phated