Zennoxa Shield
Rules / Dart
SHIELD-DART-007

Weak cryptographic hash

highDartCWE-327CVSS 7.5

What it detects

MD5 or SHA-1 from the crypto package is broken and unsuitable for passwords or integrity.

How to fix

Use SHA-256 or stronger, and bcrypt, scrypt, or Argon2 for password hashing.

Vulnerable — Shield flags thisdigest.dart
import 'dart:convert';
import 'package:crypto/crypto.dart';

String integrityDigest(String payload) {
  return md5.convert(utf8.encode(payload)).toString();
}
Fixed — scans cleandigest.dart
import 'dart:convert';
import 'package:crypto/crypto.dart';

String integrityDigest(String payload) {
  return sha256.convert(utf8.encode(payload)).toString();
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-007, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-007: Weak cryptographic hash — Zennoxa Shield