Odd hash.Sum call flow

This product is not supported for your selected Datadog site. ().
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

ID: go-security/hashsum

Language: Go

Severity: Error

Category: Error Prone

Description

When you use a hash function that implements hash.Hash, you need to use Write() to provide the data before calling Sum().

// Correct usage of hash.Hash
h := sha256.New()
h.Write(data)
sum := h.Sum(nil)
// 'sum' contains the SHA256 sum of 'data'

Since the Sum() member function takes a byte array as an argument, it is a common mistake to believe that this argument contains the data to be hashed. In reality, this argument contains some data to which the hash will be appended.

// Incorrect usage of hash.Hash
h := sha256.New()
sum := h.Sum(data)
// wrong: 'sum' contains 'data' followed by the SHA256 sum of an empty string

This rule detects these erroneous usages of hash.Hash.

Non-Compliant Code Examples

import "crypto/sha256"

func main() {
    out := make([]byte, 64)
    h := sha256.New()
    hashed := h.Sum(out)

    hashed := sha256.New().Sum(out)
}

Compliant Code Examples

import "crypto/sha256"

func main() {
    arr := []byte{1, 2, 3}
    out := make([]byte, 64)
    h := sha256.New()
    h.Write(arr)
    hashed := h.Sum(out)

    h2 := sha256.New()
    hashArr(h2, arr)
    hashed2 := h2.Sum(out)
}

func hashArr(h hash.Hash, b []byte) {
    h.Write(b)
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

원활한 통합. Datadog Code Security를 경험해 보세요

Datadog Code Security