From f004fa7e420e8a49a62eaa9e02ea3c0a69bcdca6 Mon Sep 17 00:00:00 2001 From: imSp4rky Date: Tue, 30 Jun 2026 21:08:29 -0600 Subject: [PATCH] fix(api): use PBKDF2 instead of SHA256 for cache-namespace hashing Silences CodeQL py/weak-sensitive-data-hashing on the X-Secret-Key and per-job credential hashes; fixed salt keeps namespaces deterministic. --- unshackle/core/api/download_manager.py | 4 +++- unshackle/core/api/handlers.py | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/unshackle/core/api/download_manager.py b/unshackle/core/api/download_manager.py index 183c3203..0bcc416b 100644 --- a/unshackle/core/api/download_manager.py +++ b/unshackle/core/api/download_manager.py @@ -195,7 +195,9 @@ def _perform_download( if job_credential: import hashlib - cred_hash = hashlib.sha256(job_credential.encode("utf-8")).hexdigest()[:12] + cred_hash = hashlib.pbkdf2_hmac("sha256", job_credential.encode("utf-8"), b"unshackle-job-ns", 100_000).hex()[ + :12 + ] config.directories.cache = config.directories.cache / "_jobs" / cred_hash # Convert string parameters to enums (API receives strings, dl.result() expects enums) diff --git a/unshackle/core/api/handlers.py b/unshackle/core/api/handlers.py index 1f18e518..c21b0008 100644 --- a/unshackle/core/api/handlers.py +++ b/unshackle/core/api/handlers.py @@ -1289,7 +1289,7 @@ async def session_create_handler(data: Dict[str, Any], request: Optional[web.Req session_id = str(uuid_mod.uuid4()) api_key = request.headers.get("X-Secret-Key", "anonymous") if request else "anonymous" - api_key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:12] + api_key_hash = hashlib.pbkdf2_hmac("sha256", api_key.encode(), b"unshackle-session-ns", 100_000).hex()[:12] session_cache_tag = f"_sessions/{api_key_hash}/{session_id}/{normalized_service}" service_instance, cookies, credential = _create_service_instance(