Skip to content

feat: expose public hash-unit function for diagnostic use #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joalves wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: expose public hash-unit function for diagnostic use #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions sdk/context.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,4 @@
import base64
import collections
import hashlib
import threading
from concurrent.futures import Future
from typing import Optional
Expand All @@ -10,6 +8,7 @@
from sdk.context_data_provider import ContextDataProvider
from sdk.context_event_handler import ContextEventHandler
from sdk.context_event_logger import ContextEventLogger, EventType
from sdk.internal import hashing
from sdk.internal.lock.atomic_bool import AtomicBool
from sdk.internal.lock.atomic_int import AtomicInt
from sdk.internal.lock.concurrency import Concurrency
Expand Down Expand Up @@ -536,9 +535,7 @@ def peek_treatment(self, experiment_name: str):

def get_unit_hash(self, unit_type: str, unit_uid: str):
def computer(key: str):
dig = hashlib.md5(unit_uid.encode('utf-8')).digest()
unithash = base64.urlsafe_b64encode(dig).rstrip(b'=')
return unithash
return hashing.hash_unit(unit_uid).encode('ascii')

return Concurrency.compute_if_absent_rw(
self.context_lock,
Expand Down
7 changes: 7 additions & 0 deletions sdk/internal/hashing.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
import base64
import hashlib


def hash_unit(unit: str) -> str:
dig = hashlib.md5(unit.encode('utf-8')).digest()

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the repository's declared Python support before using usedforsecurity.
rg -n \
  'requires-python|python_requires|target-version|python-version|\\.python-version|\\.tool-versions' \
  .

Repository: absmartly/python3-sdk

Length of output: 205

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- sdk/internal/hashing.py ---\n'
cat -n sdk/internal/hashing.py

printf '\n--- pyproject.toml ---\n'
cat -n pyproject.toml

Repository: absmartly/python3-sdk

Length of output: 250

🌐 Web query:

Python hashlib md5 usedforsecurity introduced version 3.9 docs

💡 Result:

The keyword-only argument usedforsecurity was introduced to the hashlib module in Python 3.9 [1][2]. All hashlib constructors (including md5) were updated in version 3.9 to include this parameter, which defaults to True [1][3]. The purpose of this parameter is to allow the use of hashing algorithms that might otherwise be blocked or considered insecure in restricted environments (such as those enforcing FIPS compliance) [1][2]. By setting usedforsecurity to False, a developer indicates that the hashing algorithm is not being used in a security-sensitive context—for example, when using a hash function strictly as a non-cryptographic, one-way compression function [1][4].

Citations:

Mark this compatibility hash as non-security use. Add usedforsecurity=False so the intent is explicit and FIPS-mode environments do not reject it. The project already requires Python >=3.9, so the keyword is available.

🧰 Tools
🪛 Ruff (0.15.21)

[error] 6-6: Probable use of insecure hash functions in hashlib: md5

(S324)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sdk/internal/hashing.py` at line 6, Update the hashlib.md5 call assigned to
dig to pass usedforsecurity=False, preserving the existing UTF-8 encoding and
digest behavior while explicitly marking the hash as compatibility-only.

Source: Linters/SAST tools

return base64.urlsafe_b64encode(dig).rstrip(b'=').decode('ascii')
Loading