rspec/rules/S4790/php/rule.adoc

include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

----
$hash = md5($data); // Sensitive
$hash = sha1($data);   // Sensitive
----

== Compliant Solution

[source,php]
----
// for a password
$hash = password_hash($password, PASSWORD_BCRYPT); // Compliant

// other context
$hash = hash("sha512", $data);
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

include::../highlighting.adoc[]

'''
== Comments And Links
(visible only on this page)

=== on 17 Oct 2018, 17:49:50 Nicolas Harraudeau wrote:
*Out of scope*:

All the following functions are out of scope:

* Hashing files is not usually performed to hide sensitive content.
** http://php.net/manual/en/function.hash-file.php[hash_file]
** http://php.net/manual/en/function.md5-file.php[md5_file]
** http://php.net/manual/en/function.sha1-file.php[sha1_file]
** http://php.net/manual/en/function.hash-hmac-file.php[hash_hmac_file]
* HMAC is is out of scope of this RSPEC
** http://php.net/manual/en/function.hash-hmac.php[hash_hmac]

include::../comments-and-links.adoc[]

endif::env-github,rspecator-view[]