From 765a8f2ab5cc0bcc3f7b7cfccec119995344cc7f Mon Sep 17 00:00:00 2001 From: Raavi29 Date: Thu, 26 Mar 2026 09:07:11 +0530 Subject: [PATCH 1/7] Add TestIsWeakHashAlgo tests for is_weak_hash_algo() in ssl.py --- tests/core/lib/test_ssl.py | 51 +++++++++++++++++++++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-) diff --git a/tests/core/lib/test_ssl.py b/tests/core/lib/test_ssl.py index e194a5db2..b7b4d3abc 100644 --- a/tests/core/lib/test_ssl.py +++ b/tests/core/lib/test_ssl.py @@ -7,9 +7,9 @@ SslEngine, SslLibrary, create_tcp_socket, - is_weak_cipher_suite, is_weak_hash_algo, is_weak_ssl_version, + is_weak_cipher_suite, ) @@ -572,3 +572,52 @@ def test_response_conditions_matched_none_response(self, ssl_engine, substeps): result = ssl_engine.response_conditions_matched(substeps.ssl_weak_version_vuln, None) assert result == [] +class TestIsWeakHashAlgo: + """ + Tests for is_weak_hash_algo(algo). + This function returns True if the algorithm is considered weak + (md2, md4, md5, sha1), and False if it is safe (sha256, sha512 etc.) + """ + + # --- WEAK algorithms — should return True --- + + def test_sha1_is_weak(self): + assert is_weak_hash_algo("sha1WithRSAEncryption") is True + + def test_md5_is_weak(self): + assert is_weak_hash_algo("md5WithRSAEncryption") is True + + def test_md2_is_weak(self): + assert is_weak_hash_algo("md2WithRSAEncryption") is True + + def test_md4_is_weak(self): + assert is_weak_hash_algo("md4WithRSAEncryption") is True + + # --- Case insensitivity — function lowercases input, so these must also work --- + + def test_sha1_uppercase_is_weak(self): + # The function does algo.lower() so uppercase should still be caught + assert is_weak_hash_algo("SHA1WithRSAEncryption") is True + + def test_md5_uppercase_is_weak(self): + assert is_weak_hash_algo("MD5WithRSAEncryption") is True + + # --- SAFE algorithms — should return False --- + + def test_sha256_is_safe(self): + assert is_weak_hash_algo("sha256WithRSAEncryption") is False + + def test_sha512_is_safe(self): + assert is_weak_hash_algo("sha512WithRSAEncryption") is False + + def test_sha384_is_safe(self): + assert is_weak_hash_algo("sha384WithRSAEncryption") is False + + # --- Edge cases --- + + def test_empty_string_does_not_crash(self): + # Empty string should return False, not raise an exception + assert is_weak_hash_algo("") is False + + def test_random_string_is_not_weak(self): + assert is_weak_hash_algo("someRandomAlgorithm") is False \ No newline at end of file From e1c59111012c65cbb6bbfa03aa8bccc7d04a9eab Mon Sep 17 00:00:00 2001 From: Raavi29 Date: Thu, 26 Mar 2026 09:23:50 +0530 Subject: [PATCH 2/7] Add TestIsWeakHashAlgo tests for is_weak_hash_algo() in ssl.py --- tests/core/lib/test_ssl.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/core/lib/test_ssl.py b/tests/core/lib/test_ssl.py index b7b4d3abc..0542f2717 100644 --- a/tests/core/lib/test_ssl.py +++ b/tests/core/lib/test_ssl.py @@ -620,4 +620,5 @@ def test_empty_string_does_not_crash(self): assert is_weak_hash_algo("") is False def test_random_string_is_not_weak(self): - assert is_weak_hash_algo("someRandomAlgorithm") is False \ No newline at end of file + assert is_weak_hash_algo("someRandomAlgorithm") is False + \ No newline at end of file From 10c12fb3ad344e8572cd4d82ed4a72f0967bc310 Mon Sep 17 00:00:00 2001 From: Raavi29 Date: Sat, 28 Mar 2026 11:19:21 +0530 Subject: [PATCH 3/7] Fix pre-commit issues: mixed line endings, ruff format --- tests/core/lib/test_ssl.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/core/lib/test_ssl.py b/tests/core/lib/test_ssl.py index 0542f2717..7c353c509 100644 --- a/tests/core/lib/test_ssl.py +++ b/tests/core/lib/test_ssl.py @@ -572,6 +572,8 @@ def test_response_conditions_matched_none_response(self, ssl_engine, substeps): result = ssl_engine.response_conditions_matched(substeps.ssl_weak_version_vuln, None) assert result == [] + + class TestIsWeakHashAlgo: """ Tests for is_weak_hash_algo(algo). @@ -621,4 +623,3 @@ def test_empty_string_does_not_crash(self): def test_random_string_is_not_weak(self): assert is_weak_hash_algo("someRandomAlgorithm") is False - \ No newline at end of file From ab2768808603b9ebd682ecaf96e0a07be999a829 Mon Sep 17 00:00:00 2001 From: Raavi29 Date: Sat, 28 Mar 2026 12:55:55 +0530 Subject: [PATCH 4/7] Trigger CI rerun From 26f67913f89896928639847c564d02dbd32282f5 Mon Sep 17 00:00:00 2001 From: Raavi29 Date: Thu, 2 Apr 2026 16:38:32 +0530 Subject: [PATCH 5/7] Add test for weak algo not at start of string (rsaWithSHA1Encryption) Addresses CodeRabbit feedback on PR #1487 - all previous weak hash tests had the weak token at the start of the string. This test confirms is_weak_hash_algo uses 'in' not 'startswith', so weak tokens are detected anywhere in the algorithm string. --- tests/core/lib/test_ssl.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/core/lib/test_ssl.py b/tests/core/lib/test_ssl.py index 7c353c509..8a66e79fd 100644 --- a/tests/core/lib/test_ssl.py +++ b/tests/core/lib/test_ssl.py @@ -623,3 +623,8 @@ def test_empty_string_does_not_crash(self): def test_random_string_is_not_weak(self): assert is_weak_hash_algo("someRandomAlgorithm") is False + + def test_weak_algo_not_at_start_of_string(self): + # is_weak_hash_algo uses 'in' not 'startswith' + # so weak token anywhere in string should be detected + assert is_weak_hash_algo("rsaWithSHA1Encryption") is True From f3a140621f05647a7b944a662664e2718c8bc817 Mon Sep 17 00:00:00 2001 From: Raavi29 Date: Sat, 4 Apr 2026 09:45:43 +0530 Subject: [PATCH 6/7] Ensure GPG signing on branch From ca2a1b02f87c02a7ab8bd792654933b93d775163 Mon Sep 17 00:00:00 2001 From: Raavi29 Date: Fri, 17 Apr 2026 16:28:30 +0530 Subject: [PATCH 7/7] refactor: fold TestIsWeakHashAlgo cases into existing parametrized test --- tests/core/lib/test_ssl.py | 63 +++++--------------------------------- 1 file changed, 7 insertions(+), 56 deletions(-) diff --git a/tests/core/lib/test_ssl.py b/tests/core/lib/test_ssl.py index 8a66e79fd..7665de646 100644 --- a/tests/core/lib/test_ssl.py +++ b/tests/core/lib/test_ssl.py @@ -463,6 +463,13 @@ def test_is_weak_cipher_suite_ssl_error(self, mock_context, mock_socket, connect ("sha1", True), ("test_algo", False), ("sha256", False), + ("md2WithRSAEncryption", True), + ("md4WithRSAEncryption", True), + ("md5WithRSAEncryption", True), + ("sha1WithRSAEncryption", True), + ("SHA1WithRSAEncryption", True), + ("MD5WithRSAEncryption", True), + ("sha256WithRSAEncryption", False), ], ) def test_is_weak_hash_algo(self, algo, expected): @@ -572,59 +579,3 @@ def test_response_conditions_matched_none_response(self, ssl_engine, substeps): result = ssl_engine.response_conditions_matched(substeps.ssl_weak_version_vuln, None) assert result == [] - - -class TestIsWeakHashAlgo: - """ - Tests for is_weak_hash_algo(algo). - This function returns True if the algorithm is considered weak - (md2, md4, md5, sha1), and False if it is safe (sha256, sha512 etc.) - """ - - # --- WEAK algorithms — should return True --- - - def test_sha1_is_weak(self): - assert is_weak_hash_algo("sha1WithRSAEncryption") is True - - def test_md5_is_weak(self): - assert is_weak_hash_algo("md5WithRSAEncryption") is True - - def test_md2_is_weak(self): - assert is_weak_hash_algo("md2WithRSAEncryption") is True - - def test_md4_is_weak(self): - assert is_weak_hash_algo("md4WithRSAEncryption") is True - - # --- Case insensitivity — function lowercases input, so these must also work --- - - def test_sha1_uppercase_is_weak(self): - # The function does algo.lower() so uppercase should still be caught - assert is_weak_hash_algo("SHA1WithRSAEncryption") is True - - def test_md5_uppercase_is_weak(self): - assert is_weak_hash_algo("MD5WithRSAEncryption") is True - - # --- SAFE algorithms — should return False --- - - def test_sha256_is_safe(self): - assert is_weak_hash_algo("sha256WithRSAEncryption") is False - - def test_sha512_is_safe(self): - assert is_weak_hash_algo("sha512WithRSAEncryption") is False - - def test_sha384_is_safe(self): - assert is_weak_hash_algo("sha384WithRSAEncryption") is False - - # --- Edge cases --- - - def test_empty_string_does_not_crash(self): - # Empty string should return False, not raise an exception - assert is_weak_hash_algo("") is False - - def test_random_string_is_not_weak(self): - assert is_weak_hash_algo("someRandomAlgorithm") is False - - def test_weak_algo_not_at_start_of_string(self): - # is_weak_hash_algo uses 'in' not 'startswith' - # so weak token anywhere in string should be detected - assert is_weak_hash_algo("rsaWithSHA1Encryption") is True