scrapinghub/dateparser

dateparser doesn't work in FIPS compliant environments

Open

#1,258 建立於 2025年3月14日

在 GitHub 查看
 (9 留言) (3 反應) (0 負責人)Python (2,318 star) (443 fork)batch import
Status: Bug confirmedType: Buggood first issue

描述

Many secure environments disable the hashlib.md5 function because it is insecure, the causes the line below to fail making dateparser unusable in these environments:

https://github.com/scrapinghub/dateparser/blob/02bd2e5dd4477b4f6db98c5e98149458eb3cc821/dateparser/conf.py#L52

This can easily be remedied by replacing that line with return hashlib.md5("".join(keys).encode("utf-8"), usedforsecurity=False).hexdigest() which appropriately bypasses the fips security check because dateparser is not using the md5 hash for security applications.

This is a great project, would appreciate it if this fix could be pushed so it becomes useable in FIPS-compliant environments!

貢獻者指南

技術棧
python
領域
security
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
1
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
under 1 hour
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
fresh
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
Pythonunderstanding of FIPS compliance
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
90
研究方向
The issue is in dateparser/conf.py line 52. The current code uses hashlib.md5(...) without the usedforsecurity parameter. To fix, change the call to hashlib.md5("".join(keys).encode("utf 8"), usedforsecurity=False).hexdigest(). No new dependencies or tests are required, but ensure existing tests pass. The maintainers may discuss if this change is acceptable for all environments.