Suppress codeql[cs/weak-crypto] in MetadataHelper.cs (#2278)

ericstj · web-flow · commit 1426561f39b0 · 2024-08-22T16:59:24.000-07:00
diff --git a/src/EntityFramework/Core/Common/Utils/MetadataHelper.cs b/src/EntityFramework/Core/Common/Utils/MetadataHelper.cs
@@ -765,6 +765,7 @@ internal static HashAlgorithm CreateMetadataHashAlgorithm(double schemaVersion)
             if (schemaVersion < XmlConstants.EdmVersionForV2)
             {
                 // v1 and v1.1 use old hash to remain compatible
+                // codeql[cs/weak-crypto] MD5CryptoServiceProvider is not used for cryptography/security purposes and we do it only for v1 and v1.1 for compatibility reasons.
                 hashAlgorithm = new MD5CryptoServiceProvider();
             }
             else

Original file line number	Diff line number	Diff line change
`@@ -765,6 +765,7 @@ internal static HashAlgorithm CreateMetadataHashAlgorithm(double schemaVersion)`
`765`	`765`	`if (schemaVersion < XmlConstants.EdmVersionForV2)`
`766`	`766`	`{`
`767`	`767`	`// v1 and v1.1 use old hash to remain compatible`
	`768`	`+ // codeql[cs/weak-crypto] MD5CryptoServiceProvider is not used for cryptography/security purposes and we do it only for v1 and v1.1 for compatibility reasons.`
`768`	`769`	`hashAlgorithm = new MD5CryptoServiceProvider();`
`769`	`770`	`}`
`770`	`771`	`else`