Skip to content

fix(transformations): compute empty md5 and sha1 digests lazily #1629

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jspdown wants to merge 1 commit into
base: main
Choose a base branch
from
+20 −12
Open

fix(transformations): compute empty md5 and sha1 digests lazily #1629

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions internal/transformations/md5.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,23 @@ package transformations
import (
"crypto/md5"
"io"
"sync"

"github.com/corazawaf/coraza/v3/internal/strings"
)

var emptyMD5 string
var (
emptyMD5 string
emptyMD5Once sync.Once
)

func md5T(data string) (string, bool, error) {
if len(data) == 0 {
// Computed lazily to avoid calling MD5 in an init, which panics under GODEBUG=fips140=only.
emptyMD5Once.Do(func() {
sum := md5.Sum(nil)
emptyMD5 = string(sum[:])
})
return emptyMD5, true, nil
}

Expand All @@ -26,8 +35,3 @@ func md5T(data string) (string, bool, error) {
// https://crypto.stackexchange.com/questions/68674/md5-existence-of-invariant-fixed-point
return strings.WrapUnsafe(h.Sum(nil)), true, nil
}

func init() {
buf := md5.Sum(nil)
emptyMD5 = string(buf[:])
}
16 changes: 10 additions & 6 deletions internal/transformations/sha1.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,23 @@ package transformations
import (
"crypto/sha1"
"io"
"sync"

"github.com/corazawaf/coraza/v3/internal/strings"
)

var emptySHA1 string
var (
emptySHA1 string
emptySHA1Once sync.Once
)

func sha1T(data string) (string, bool, error) {
if len(data) == 0 {
// Computed lazily to avoid calling SHA-1 in an init, which panics under GODEBUG=fips140=only.
emptySHA1Once.Do(func() {
sum := sha1.Sum(nil)
emptySHA1 = string(sum[:])
})
return emptySHA1, true, nil
}
h := sha1.New()
Expand All @@ -24,8 +33,3 @@ func sha1T(data string) (string, bool, error) {
// The occurrence of an invariant transformation is so unlikely that we can assume the transformation returns a changed value
return strings.WrapUnsafe(h.Sum(nil)), true, nil
}

func init() {
buf := sha1.Sum(nil)
emptySHA1 = string(buf[:])
}
Loading