Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-009

Weak hash algorithm via MessageDigest.getInstance

mediumKotlinCWE-327CVSS 5.9

What it detects

MessageDigest.getInstance with MD5 or SHA-1 uses a broken hash unsuitable for security purposes.

How to fix

Use SHA-256 or stronger, and for passwords use a KDF such as bcrypt, scrypt, or PBKDF2.

Vulnerable — Shield flags thisFingerprint.kt
import java.security.MessageDigest

fun fingerprint(data: ByteArray): String {
    val digest = MessageDigest.getInstance("MD5").digest(data)
    return digest.joinToString("") { "%02x".format(it) }
}
Fixed — scans cleanFingerprint.kt
import java.security.MessageDigest

fun fingerprint(data: ByteArray): String {
    val digest = MessageDigest.getInstance("SHA-256").digest(data)
    return digest.joinToString("") { "%02x".format(it) }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-009, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-009: Weak hash algorithm via MessageDigest.getInstance — Zennoxa Shield