Use a constant for weak hashes (#850)

Small change to have a variable that has the set of weak hashes. Signed-off-by: Eric Brown <browne@vmware.com>
PyCQA · Mar 6, 2022 · a65c5b6 · a65c5b6
1 parent 808bac2
commit a65c5b6
Showing 1 changed file with 6 additions and 13 deletions.
diff --git a/bandit/plugins/hashlib_insecure_functions.py b/bandit/plugins/hashlib_insecure_functions.py
@@ -46,6 +46,9 @@
 from bandit.core import test_properties as test
 
 
+WEAK_HASHES = ("md4", "md5", "sha", "sha1")
+
+
 def _hashlib_func(context):
     if isinstance(context.call_function_name_qual, str):
         qualname_list = context.call_function_name_qual.split(".")
@@ -54,7 +57,7 @@ def _hashlib_func(context):
             func = qualname_list[-1]
             keywords = context.call_keywords
 
-            if func in ("md4", "md5", "sha", "sha1"):
+            if func in WEAK_HASHES:
                 if keywords.get("usedforsecurity", "True") == "True":
                     return bandit.Issue(
                         severity=bandit.HIGH,
@@ -67,12 +70,7 @@ def _hashlib_func(context):
             elif func == "new":
                 args = context.call_args
                 name = args[0] if args else keywords.get("name", None)
-                if isinstance(name, str) and name.lower() in (
-                    "md4",
-                    "md5",
-                    "sha",
-                    "sha1",
-                ):
+                if isinstance(name, str) and name.lower() in WEAK_HASHES:
                     if keywords.get("usedforsecurity", "True") == "True":
                         return bandit.Issue(
                             severity=bandit.HIGH,
@@ -93,12 +91,7 @@ def _hashlib_new(context):
             args = context.call_args
             keywords = context.call_keywords
             name = args[0] if args else keywords.get("name", None)
-            if isinstance(name, str) and name.lower() in (
-                "md4",
-                "md5",
-                "sha",
-                "sha1",
-            ):
+            if isinstance(name, str) and name.lower() in WEAK_HASHES:
                 return bandit.Issue(
                     severity=bandit.MEDIUM,
                     confidence=bandit.HIGH,