dateparser doesn't work in FIPS compliant environments · scrapinghub/dateparser#1258

(9 comments) (3 reactions) (0 assignees)Python (2,318 stars) (443 forks)batch import

Status: Bug confirmedType: Buggood first issue

説明

Many secure environments disable the hashlib.md5 function because it is insecure, the causes the line below to fail making dateparser unusable in these environments:

https://github.com/scrapinghub/dateparser/blob/02bd2e5dd4477b4f6db98c5e98149458eb3cc821/dateparser/conf.py#L52

This can easily be remedied by replacing that line with return hashlib.md5("".join(keys).encode("utf-8"), usedforsecurity=False).hexdigest() which appropriately bypasses the fips security check because dateparser is not using the md5 hash for security applications.

This is a great project, would appreciate it if this fix could be pushed so it becomes useable in FIPS-compliant environments!

コントリビューターガイド

技術スタック: python
領域: security
Issue 種別: bug
難度: 1
推定時間: under 1 hour
活動状況: fresh
明確さ: clear
前提条件: Pythonunderstanding of FIPS compliance
初心者向け度: 90
調査方針: The issue is in dateparser/conf.py line 52. The current code uses hashlib.md5(...) without the usedforsecurity parameter. To fix, change the call to hashlib.md5("".join(keys).encode("utf 8"), usedforsecurity=False).hexdigest(). No new dependencies or tests are required, but ensure existing tests pass. The maintainers may discuss if this change is acceptable for all environments.