FastDigestUsedForPasswordStorage

warning native on by default

Group: Security

Detect a password input positively established by an HTML password-field mapping or explicit annotated password parameter reaching md5/sha1/hash and then a persisted credential field.

Example

<?php
/** @custos-credential-store */ function saveCredential($hash) {}
/** @param password-string $password */ function bad($password) { saveCredential(md5($password)); }

Reported:

• line 3: Store passwords with a password hashing API.

Detection

• Report a password input positively established by an HTML password-field mapping or explicit annotated password parameter reaching md5/sha1/hash and then a persisted credential field.
• Recognize password inputs only through an exact @param password-string $parameter annotation on their declaring callable or a positively resolved HTML password-field mapping. Recognize persistence only through a resolved project callable explicitly documented with @custos-credential-store. Do not infer either contract from identifiers.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• General integrity checks, hash-based message authentication, password_hash, variable-name-only guesses and unknown persistence are excluded.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

No automatic fix: migrating existing credential storage and verification requires compatibility policy.

PHP versions

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "FastDigestUsedForPasswordStorage": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore FastDigestUsedForPasswordStorage