Merge pull request #88 from ddulic/fix/md5-usedforsecurity-false

fix(security): add usedforsecurity=False to all hashlib.md5 calls

Author: ddulic

supernote/cli/admin.py

@@ -36,7 +36,7 @@ async def add_user_async(
 
         # Hash password
         _warn_md5_usage()
-        password_md5 = hashlib.md5(password.encode()).hexdigest()
+        password_md5 = hashlib.md5(password.encode(), usedforsecurity=False).hexdigest()
 
         # Try Public Registration
         try:
@@ -123,7 +123,7 @@ async def reset_password_async(url: str, email: str, password: str) -> None:
         admin_client = AdminClient(session.client)
 
         _warn_md5_usage()
-        password_md5 = hashlib.md5(password.encode()).hexdigest()
+        password_md5 = hashlib.md5(password.encode(), usedforsecurity=False).hexdigest()
 
         try:
             await admin_client.admin_reset_password(email, password_md5)

supernote/client/client.py

@@ -281,7 +281,7 @@ async def _upload_to_oss(
                 raise ValueError("No upload URL available")
 
             # Compute MD5 of content for verification
-            content_md5 = hashlib.md5(content).hexdigest()
+            content_md5 = hashlib.md5(content, usedforsecurity=False).hexdigest()
 
             _LOGGER.debug(
                 "Uploading file %s in one chunk (MD5: %s)", filename, content_md5
@@ -324,7 +324,7 @@ async def _upload_to_oss(
         # Break into chunks
         chunks = [content[i : i + chunk_size] for i in range(0, size, chunk_size)]
         for i, chunk in enumerate(chunks):
-            chunk_md5 = hashlib.md5(chunk).hexdigest()
+            chunk_md5 = hashlib.md5(chunk, usedforsecurity=False).hexdigest()
             _LOGGER.debug(f"Uploading chunk {i + 1} of {size} ({len(chunk)} bytes)")
             data = FormData()
             data.add_field("file", chunk, filename=filename)

supernote/client/device.py

@@ -173,7 +173,7 @@ async def upload_content(
         _LOGGER.debug("Initiating upload for file %s", path)
         apply = await self.upload_apply(filename, path, size, equipment_no)
 
-        md5 = hashlib.md5(content).hexdigest()
+        md5 = hashlib.md5(content, usedforsecurity=False).hexdigest()
 
         await self._client._upload_to_oss(
             content,

supernote/client/hashing.py

@@ -35,7 +35,7 @@ def _md5_string(s: str) -> str:
     Security Warning: MD5 is cryptographically broken but required for Supernote protocol compatibility.
     """
     _warn_md5_usage()
-    return hashlib.md5(s.encode("utf-8")).hexdigest()
+    return hashlib.md5(s.encode("utf-8"), usedforsecurity=False).hexdigest()
 
 
 def hash_with_salt(content: str, salt: str) -> str:

supernote/client/web.py

@@ -177,7 +177,7 @@ async def folder_list_query(
 
     async def upload_file(self, parent_id: int, name: str, content: bytes) -> None:
         """Upload a file (Web API)."""
-        md5 = hashlib.md5(content).hexdigest()
+        md5 = hashlib.md5(content, usedforsecurity=False).hexdigest()
         size = len(content)
 
         # Apply to get an upload endpoint

supernote/server/services/blob.py

@@ -106,7 +106,7 @@ async def put(
         temp_path = temp_dir / f"{secrets.token_hex(8)}.tmp"
 
         total_size = 0
-        md5_hasher = hashlib.md5()
+        md5_hasher = hashlib.md5(usedforsecurity=False)
 
         try:
             async with aiofiles.open(temp_path, "wb") as f:
@@ -191,7 +191,7 @@ async def get_metadata(
             return BlobMetadata(size=stat.st_size)
 
         # Compute MD5 and size
-        md5_hasher = hashlib.md5()
+        md5_hasher = hashlib.md5(usedforsecurity=False)
         read_size = 0
         async with aiofiles.open(path, "rb") as f:
             while True: