From d65c762ab4b6e3698058cf82ac917410f56c2a70 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Tue, 10 Nov 2026 23:23:39 +0000 Subject: [PATCH] sonar: MD5 in PDF encryption is the format's, not a choice MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Records why rust:S4790 (`crates/pdf/src/encrypt.rs`) stays, like wordcraft#6187 did for SHA-1 in ODT. MD5 is the key derivation of the PDF standard security handler revisions 2-4 (ISO 32000-1 §7.6.3.3), which PDF 1.3-1.6 encryption uses. It's needed to read those files and to write the compatibility the user picks. The default, 256-bit AES (revision 6), hashes with SHA-2. --- sonar-project.properties | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sonar-project.properties b/sonar-project.properties index dc74b9bd0..287b7eb9c 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -1,2 +1,10 @@ sonar.projectKey=storytold_vectorcraft sonar.organization=storytold + +# S4790 (weak hash): MD5 is the key derivation of the PDF standard security handler revisions 2-4 +# (ISO 32000-1 §7.6.3.3), which PDF 1.3-1.6 files use. It is needed to read those files and to write +# the compatibility the user picks, not chosen for new security: the default is 256-bit AES +# (revision 6), which hashes with SHA-2. +sonar.issue.ignore.multicriteria=pdf_md5 +sonar.issue.ignore.multicriteria.pdf_md5.ruleKey=rust:S4790 +sonar.issue.ignore.multicriteria.pdf_md5.resourceKey=crates/pdf/src/encrypt.rs