Try to fix CodeQL Security Warnings

ZeliardM · Oct 18, 2025 · Oct 19, 2025 · Oct 19, 2025 · Oct 19, 2025 · Oct 21, 2025
commit 3b15fdd4207aa3d8f2bef085406edacd05189e95
diff --git a/kasa/transports/tpaptransport.py b/kasa/transports/tpaptransport.py
@@ -510,16 +510,16 @@
     @staticmethod
     def _md5_hex(s: str) -> str:
         # codeql[py/weak-cryptographic-algorithm]:
-        # Required by device firmware for credential shadow compatibility.
+        # Required by device firmware for credential compatibility.
         # Do not change.
-        return hashlib.md5(s.encode()).hexdigest()  # nosec B303 # noqa: S324
+        return hashlib.md5(s.encode()).hexdigest()  # nosec B303  # noqa: S324
 
     @staticmethod
     def _sha1_hex(s: str) -> str:
         # codeql[py/weak-cryptographic-algorithm]:
-        # Required by device firmware for credential shadow compatibility.
+        # Required by device firmware for credential compatibility.
         # Do not change.
-        return hashlib.sha1(s.encode()).hexdigest()  # nosec B303 # noqa: S324
+        return hashlib.sha1(s.encode()).hexdigest()  # nosec B303  # noqa: S324
 
     @classmethod
     def _authkey_mask(cls, passcode: str, tmpkey: str, dictionary: str) -> str:
@@ -545,9 +545,9 @@
     @staticmethod
     def _sha256crypt_simple(passcode: str, prefix: str) -> str:
         # codeql[py/weak-cryptographic-algorithm]:
-        # Device-advertised "password_shadow" pid=5 format;
-        # not general-purpose password hashing.
-        return prefix + "$" + hashlib.sha256(passcode.encode()).hexdigest()
+        # Required by device firmware for credential compatibility.
+        # Do not change.
+        return prefix + "$" + hashlib.sha256(passcode.encode()).hexdigest()  # nosec B303  # noqa: S324
 
     @classmethod
     def _build_credentials(
@@ -596,9 +596,9 @@
                 name = "admin" if sha_name == 0 else "user"
                 salt_dec = base64.b64decode(sha_salt_b64).decode()
                 # codeql[py/weak-cryptographic-algorithm]:
-                # Device-advertised "password_sha_with_salt" format;
-                # not general-purpose password hashing.
-                return hashlib.sha256((name + salt_dec + passcode).encode()).hexdigest()
+                # Required by device firmware for credential compatibility.
+                # Do not change.
+                return hashlib.sha256((name + salt_dec + passcode).encode()).hexdigest()  # nosec B303  # noqa: S324
             except Exception:
                 return passcode
 

diff --git a/tests/transports/test_tpaptransport.py b/tests/transports/test_tpaptransport.py
@@ -83,9 +83,15 @@
 def test_sha1_username_mac_shadow():
     username = "user"
     mac12 = "aabbccddeeff"
-    expected = hashlib.sha1(  # noqa: S324
+    # codeql[py/weak-cryptographic-algorithm]:
+    # Required by device firmware for credential compatibility.
+    # Do not change.
+    expected = hashlib.sha1(  # nosec B303  # noqa: S324
         (
-            hashlib.md5(username.encode()).hexdigest() + "_" + "AA:BB:CC:DD:EE:FF"  # noqa: S324
+            # codeql[py/weak-cryptographic-algorithm]:
+            # Required by device firmware for credential compatibility.
+            # Do not change.
+            hashlib.md5(username.encode()).hexdigest() + "_" + "AA:BB:CC:DD:EE:FF"  # nosec B303  # noqa: S324
         ).encode()
     ).hexdigest()
     out = TpapTransport._sha1_username_mac_shadow(username, mac12, "ignored")
@@ -96,10 +102,16 @@
 def test_password_shadow_variants():
     extra = {"type": "password_shadow", "params": {"passwd_id": 1}}
     out = TpapTransport._build_credentials(extra, "", "pw", "")
-    assert out == hashlib.md5(b"pw").hexdigest()  # noqa: S324
+    # codeql[py/weak-cryptographic-algorithm]:
+    # Required by device firmware for credential compatibility.
+    # Do not change.
+    assert out == hashlib.md5(b"pw").hexdigest()  # nosec B303  # noqa: S324
     extra = {"type": "password_shadow", "params": {"passwd_id": 2}}
     out = TpapTransport._build_credentials(extra, "", "pw", "")
-    assert out == hashlib.sha1(b"pw").hexdigest()  # noqa: S324
+    # codeql[py/weak-cryptographic-algorithm]:
+    # Required by device firmware for credential compatibility.
+    # Do not change.
+    assert out == hashlib.sha1(b"pw").hexdigest()  # nosec B303  # noqa: S324
     extra = {
         "type": "password_shadow",
         "params": {"passwd_id": 5, "passwd_prefix": "x"},