S324 false negatives for synonyms of insecure algorithm names

[dscorbett]

Summary

hashlib-insecure-hash-function (S324) misses some insecure algorithm names that are equivalent to names that it currently flags. "ssl3-md5" and "1.2.840.113549.2.5" are synonyms of "md5". "sha-1", "ssl3-sha1", and "1.3.14.3.2.26" are synonyms of "sha1". Trailing spaces are ignored after any name. The details depend on the version of OpenSSL that Python is using, but those are the false negatives I’ve found on my machine.

import hashlib
print(hashlib.new("md5  ").hexdigest())
print(hashlib.new("sha-1").hexdigest())
print(hashlib.new("ssl3-md5").hexdigest())
print(hashlib.new("ssl3-sha1").hexdigest())
print(hashlib.new("1.3.14.3.2.26").hexdigest())
print(hashlib.new("1.2.840.113549.2.5").hexdigest())

Version

ruff 0.9.10 (0dfa810 2025-03-07)