MPV-Remote02.md

CogniCrypt (report 2) for mpv-remote

• Class: miccah.mpvremote.HMAC

• Method: digest

• Line: 29

• Issue details: ConstraintError-1

  • ConstraintError violating CrySL rule for javax.crypto.Mac.

  • First parameter (with value \HmacMD5) should be any of {HmacSHA256, HmacSHA384, HmacSHA512, HmacPBESHA1, PBEWithHmacSHA1, PBEWithHmacSHA224, PBEWithHmacSHA256, PBEWithHmacSHA384, PBEWithHmacSHA512}.

Code

 public String digest() {
      String digest = null;
      try {
          SecretKeySpec key = new SecretKeySpec(
                  keyString.getBytes("UTF-8"), algorithm);
          Mac mac = Mac.getInstance(algorithm);
          mac.init(key);

          byte[] bytes = mac.doFinal(message.getBytes("UTF-8"));

          StringBuffer hash = new StringBuffer();
          for (int i = 0; i < bytes.length; i++) {
              String hex = Integer.toHexString(0xFF & bytes[i]);
              if (hex.length() == 1) {
                  hash.append('0');
              }
              hash.append(hex);
          }
          digest = hash.toString();
      } catch (Exception e) {}
      return digest;
  }

Questions

1. How likely might this warning reveal a security threat to this app?

2. Are you likely to accept a patch that fixes this particular issue?