By mondrake on
Change record status:
Published (View all published change records)
Project:
Introduced in branch:
12.0.x
Introduced in version:
12.0.0
Issue links:
Description:
Use of certain weak hashing function was already discouraged in Never use crc32b, md5, sha1, and other weak hashes in Drupal code.
Now Drupal's PHPStan analysis reports as errors the usage of crc32(), md5(), sha1() and hash() with weak encryption algorithms.
For data hashing, use hash() with a fast, low collision, non-cryptographic algorithm when appropriate (usually one of the xxHash variants), don't use weak cryptographic algorithms. See https://xxhash.com/.
For cryptographic hashing, see the Crypt class for common use-cases.
Impacts:
Module developers