For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/dart-security/weak-hash-algorithm.md. A documentation index is available at /llms.txt.

Avoid broken or weak cryptographic hash algorithms

This product is not supported for your selected Datadog site. ().

Metadata

ID: dart-security/weak-hash-algorithm

Language: Dart

Severity: Warning

Category: Security

CWE: 327

Related CWEs:

Description

MD5 and SHA-1 are cryptographically broken and collision-prone. Using them for digital signatures, data integrity checks, or message authentication provides no real security guarantee.

Replace them with SHA-256 or stronger (sha256, sha512 from the crypto package). MD5 and SHA-1 are only acceptable for non-security purposes such as cache keys or non-security checksums where collision resistance is irrelevant.

Non-Compliant Code Examples

import 'package:crypto/crypto.dart';
import 'dart:convert';

String checksumForSecurity(String input) {
  final digest = md5.convert(utf8.encode(input));
  return digest.toString();
}

import 'package:crypto/crypto.dart';
import 'dart:convert';

String signData(List<int> data) {
  return sha1.convert(data).toString();
}

import 'package:crypto/crypto.dart';
import 'dart:convert';

void processData(List<int> data) {
  final h1 = md5.convert(data);
  final h2 = sha1.convert(data);
}

Compliant Code Examples

import 'package:crypto/crypto.dart';
import 'dart:convert';

String hashData(String input) {
  final digest = sha256.convert(utf8.encode(input));
  return digest.toString();
}

import 'package:crypto/crypto.dart';
import 'dart:convert';

String hashData(List<int> data) {
  return sha512.convert(data).toString();
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Security

Datadog Code Security