>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3554327. --> Reported by: [owen barton](https://www.drupal.org/user/19668) Related to !9 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>If someone is writing a tool to scan for insecure JS libraries, the current approach seems like it could be defeated trivially given that the search space is so small (version numbers have a pretty predictable format).</p> <p>Whilst it's also not that hard to detect the JS files other ways (e.g. probing their non-aggregated paths or checking for version specific strings in the output) it does seem like if the goal is actually obscuring the versions it would be worth making this a little harder.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <p>I tested iterating through all versions v0.0.0 through v100.100.100 using xxh32 and it took 0.07 seconds to iterate through all 1M of them - this is using PHP (using C would be way faster). In addition, someone building a scanner would only have to do this once to check all versions of every library on every Drupal site.</p> <p>The other issue is that adding a salt is not really useful on it's own - xxh32 is fast enough someone could fairly easily reverse the salt (a good reason to NOT use one of the Drupal instance salts/secrets with this algo!) so switching to something that is much harder to reverse would be good.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Generate a random salt on install/upgrade, then use that with the library name/path to generate hashes like:<br> substr(Crypt::hmacBase64($item['version'], $this-&gt;getPrivateKey() . $this-&gt;getHashSalt()), 0, 8);</p> <p>This switches to the algo core is using (currently SHA-256) which is not going to be reversible for a long time, given the input data size.</p> <p>I would also suggest concatenating the library name to the version number - this is easy to do and this means that libraries with the same version number still get different hashes.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p>Well, this could totally be argued as overkill for a module that is arguably of limited value anyway, so totally feel free to eyeroll and close this out as won't do ;)</p> <h3 id="summary-ui-changes">User interface changes</h3> <p>N/A</p> <h3 id="testing-steps">Testing steps</h3> <ol> <li>Click the tugboat preview link (near the merge request on this page)</li> <li>login as u: admin p: admin</li> <li>go to /update.php</li> <li>view the page source</li> <li>scroll to the bottom and look for jquery.min.js?v=</li> <li>validate that the 8 characters that follow the 'v=' are random jibberish</li> </ol>