Hello everyone.

During our recent internal security review we found that the Bootstrap module is using MD5 in order to generate accordion div elements IDs.

In this instance MD5 isn’t being used in a security context but MD5 has been deemed insecure and I (like anyone else who is interested in FIPS - Federal Information Processing Standards) need to get an exemption for every use of MD5.
The reasoning behind removing MD5 from Drupal has been discussed already: http://engineeredweb.com/blog/10/5/new-way-generate-hashes-drupal-7/ and the Drupal Core had agreed and already completed the work by removing all instances of MD5 from the code base: https://drupal.org/node/723802.

It is easy to fix this by using hash('sha256', $elements) instead.
Could we consider to make this module FIPS compatible?

Many thanks

Comments

Fabio.E.Questionmark’s picture

StatusFileSize
new1.12 KB

Please find attached a patch to remove md5 usage

Fabio.E.Questionmark’s picture

Status: Active » Needs review
markhalliwell’s picture

Title: md5 usage should be removed » Remove deprecated bootstrap_accordion theme hook
Category: Support request » Task
Status: Needs review » Fixed
Issue tags: -md5, -fips

Actually this entire theme hook should just be removed (legacy code). The bootstrap_panel theme hook should be used instead.

Committed adda527 to 7.x-3.x:

Issue #2215421 by Mark Carver | Fabio.E.Questionmark: Remove deprecated bootstrap_accordion theme hook.

markhalliwell’s picture

markhalliwell’s picture

Title: Remove deprecated bootstrap_accordion theme hook » Remove legacy bootstrap_accordion theme hook

Reflects more accurately, it was never "officially" deprecated... just overlooked. Added a draft change notice that will need to be published once 7.x-3.1 is released.

markhalliwell’s picture

Version: 7.x-3.x-dev » 8.x-3.x-dev
Assigned: Unassigned » ryan.armstrong
Priority: Normal » Critical
Status: Fixed » Needs review

  • Commit adda527 on 7.x-3.x, 8.x-3.x by Mark Carver:
    Issue #2215421 by Mark Carver | Fabio.E.Questionmark: Remove deprecated...
m1r1k’s picture

Assigned: ryan.armstrong » Unassigned
Status: Needs review » Closed (won't fix)

bootstrap_accordion.func.php was removed from 8.x-3.x as well as manually generated Id attribute.

  • Mark Carver committed adda527 on 8.x-3.x.x
    Issue #2215421 by Mark Carver | Fabio.E.Questionmark: Remove deprecated...