Ccodemod

codemod/cryptojs-sha1-to-sha256

Transform CryptoJS.SHA1() calls to use CryptoJS.SHA256() for improved security. SHA-1 is cryptographically broken and vulnerable to collision attacks.

securitycryptojssha1sha256vulnerabilitymigration
Public
0 executions
Use dashboardApply to Repository

Run locally

npx codemod @codemod/cryptojs-sha1-to-sha256

CryptoJS SHA-1 to SHA-256 Migration Codemod

🔒 Critical Security Upgrade: Automatically migrates CryptoJS SHA-1 usage to SHA-256 to address cryptographic vulnerabilities.

Overview

SHA-1 is cryptographically broken and vulnerable to collision attacks. This codemod helps you upgrade from the deprecated SHA-1 algorithm to the more secure SHA-256, ensuring your application maintains cryptographic integrity.

Security Impact

  • Vulnerability: SHA-1 collision attacks (CVE-2020-0601)
  • CWE: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)
  • OWASP: A02 - Cryptographic Failures
  • Severity: Critical

Installation & Usage

bash

Transformations

ES6/ESM Imports

Before:

javascript

After:

javascript

Default Imports

Before:

javascript

After:

javascript

CommonJS Destructuring

Before:

javascript

After:

javascript

Method Chaining

Before:

javascript

After:

javascript

Variable References

Before:

javascript

After:

javascript

Aliased Imports

Before:

javascript

After:

javascript

What Won't Be Transformed

  • String literals containing "SHA1" (preserved intentionally)
  • Comments mentioning SHA1
  • Custom functions named SHA1 (not from crypto-js)
  • Already upgraded SHA256 usage
  • Test files (configurable exclusion)

Important Notes

⚠️ Hash Length Change: SHA-256 produces 64-character hex strings vs SHA-1's 40-character strings. Review any code that depends on specific hash lengths.

✅ API Compatibility: The CryptoJS API remains the same - only the algorithm changes.

🔍 Manual Review Recommended: While this codemod handles most cases automatically, review the changes to ensure correctness in your specific context.

File Types Supported

  • .js - JavaScript
  • .ts - TypeScript
  • .jsx - React JSX
  • .tsx - React TypeScript JSX

Excluded Patterns

The codemod automatically excludes:

  • node_modules/
  • Test files (*.test.*, *.spec.*)
  • Test directories (test/, tests/, __tests__/)

Development

bash

Security References

License

MIT

Powered by Codemod | Built with ast-grep

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community