@codemod/cryptojs-md5-to-sha256

A security-focused codemod that transforms CryptoJS.MD5() calls to use CryptoJS.SHA256() for stronger cryptographic security. MD5 is cryptographically broken and vulnerable to collision attacks, making it unsuitable for security-sensitive applications.

Security Impact

This codemod addresses critical security vulnerabilities:

• CWE-327: Use of a Broken or Risky Cryptographic Algorithm
• MITRE ATT&CK T1588.002: Obtain Capabilities: Tool
• CVE-2004-2761: MD5 collision vulnerabilities
• CVE-2008-4697: MD5 collision attacks

MD5 has known vulnerabilities and should be replaced with stronger hash functions like SHA-256 for security-critical applications.

Installation

bash
Copy
# Run directly from registry
npx codemod@latest run @codemod/cryptojs-md5-to-sha256

# Or install and run locally
npm install -g @codemod/cryptojs-md5-to-sha256
codemod run @codemod/cryptojs-md5-to-sha256

What It Does

This codemod automatically transforms MD5 usage to SHA-256 in JavaScript and TypeScript files:

Basic Transformations

Before:

javascript
Copy
const hash = CryptoJS.MD5('hello world');

After:

javascript
Copy
const hash = CryptoJS.SHA256('hello world');

Method Chaining

Before:

javascript
Copy
const digest = CryptoJS.MD5(data).toString();
const hexHash = CryptoJS.MD5(input).toString(CryptoJS.enc.Hex);

After:

javascript
Copy
const digest = CryptoJS.SHA256(data).toString();
const hexHash = CryptoJS.SHA256(input).toString(CryptoJS.enc.Hex);

Variable Assignments and Return Statements

Before:

javascript
Copy
function generateHash(password, salt) {
  return CryptoJS.MD5(password + salt);
}

let userHash = CryptoJS.MD5(userData);

After:

javascript
Copy
function generateHash(password, salt) {
  return CryptoJS.SHA256(password + salt);
}

let userHash = CryptoJS.SHA256(userData);

What It Preserves

The codemod is designed to be conservative and safe:

• Files with @preserve-md5 comments - Skip transformation entirely
• Non-CryptoJS files - Only processes files that contain CryptoJS usage
• Other CryptoJS methods - Only transforms MD5, leaves SHA1, SHA256, HMAC, etc. unchanged
• Comments and formatting - Preserves code structure and comments
• Method chaining - Maintains the same API structure

Target Files

• JavaScript (.js)
• TypeScript (.ts)
• JSX (.jsx)
• TSX (.tsx)

Excludes test files, node_modules, and build directories by default.

Important Notes

⚠️ Hash Output Length Change: SHA-256 produces 64-character hex strings compared to MD5's 32 characters. Code consuming these hashes may need updates to handle the different length.

⚠️ Review Required: While this codemod automates the transformation, review the changes to ensure they meet your application's requirements.

Running the Codemod

bash
Copy
# Transform current directory
npx codemod@latest run @codemod/cryptojs-md5-to-sha256

# Transform specific directory
npx codemod@latest run @codemod/cryptojs-md5-to-sha256 /path/to/project

# Preview changes without applying
npx codemod@latest run @codemod/cryptojs-md5-to-sha256 --dry-run

Development

bash
Copy
# Clone and setup
git clone <repository>
cd cryptojs-md5-to-sha256
pnpm install

# Run tests
pnpm test

# Test on sample code
pnpm test --filter basic-md5-transform

# Update test snapshots if needed
pnpm test -u

Security References

• CWE-327: Use of a Broken or Risky Cryptographic Algorithm
• MITRE ATT&CK T1588.002: Obtain Capabilities: Tool
• RFC 6151: Updated Security Considerations for MD5
• NIST SP 800-131A: Cryptographic Algorithm Policy

License

MIT