merge magento-commerce/2.4-develop into magento-tsg/2.4-develop-pr142

Author: magento-mts-svc

app/code/Magento/AdminNotification/Model/System/Message/Baseurl.php

@@ -101,6 +101,8 @@ protected function _getConfigUrl()
      */
     public function getIdentity()
     {
+        // md5() here is not for cryptographic use.
+        // phpcs:ignore Magento2.Security.InsecureFunction
         return md5('BASE_URL' . $this->_getConfigUrl());
     }
 

app/code/Magento/AdminNotification/Model/System/Message/CacheOutdated.php

@@ -62,6 +62,8 @@ protected function _getCacheTypesForRefresh()
      */
     public function getIdentity()
     {
+        // md5() here is not for cryptographic use.
+        // phpcs:ignore Magento2.Security.InsecureFunction
         return md5('cache' . implode(':', $this->_getCacheTypesForRefresh()));
     }
 

app/code/Magento/AsynchronousOperations/Model/ResourceModel/System/Message/Collection/Synchronized/Plugin.php

@@ -108,6 +108,8 @@ public function afterToArray(
                     'data' => [
                         'text' => __('Task "%1": ', $bulk->getDescription()) . $text,
                         'severity' => \Magento\Framework\Notification\MessageInterface::SEVERITY_MAJOR,
+                        // md5() here is not for cryptographic use.
+                        // phpcs:ignore Magento2.Security.InsecureFunction
                         'identity' => md5('bulk' . $bulkUuid),
                         'uuid' => $bulkUuid,
                         'status' => $bulkStatus,

app/code/Magento/Backend/Test/Mftf/Helper/CurlHelpers.php

@@ -49,6 +49,8 @@ public function assertImageContentIsEqual($url, $expectedString, $postBody = nul
         $imageContent = $this->getCurlResponse($url, $cookie, $postBody);
         // Must make request twice until bug is resolved: B2B-1789
         $imageContent = $this->getCurlResponse($url, $cookie, $postBody);
+        // md5() here is not for cryptographic use.
+        // phpcs:ignore Magento2.Security.InsecureFunction
         $imageContentMD5 = md5($imageContent);
         $this->assertStringContainsString($expectedString, $imageContentMD5, $message);
     }

app/code/Magento/Catalog/Block/Navigation.php

@@ -152,6 +152,8 @@ public function getCacheKeyInfo()
 
         $shortCacheId = array_values($shortCacheId);
         $shortCacheId = implode('|', $shortCacheId);
+        // md5() here is not for cryptographic use.
+        // phpcs:ignore Magento2.Security.InsecureFunction
         $shortCacheId = md5($shortCacheId);
 
         $cacheId['category_path'] = $this->getCurrentCategoryKey();

app/code/Magento/Catalog/Controller/Adminhtml/Product/Attribute.php

@@ -126,6 +126,8 @@ protected function generateCode($label)
         );
         $validatorAttrCode = new \Zend_Validate_Regex(['pattern' => '/^[a-z][a-z_0-9]{0,29}[a-z0-9]$/']);
         if (!$validatorAttrCode->isValid($code)) {
+            // md5() here is not for cryptographic use.
+            // phpcs:ignore Magento2.Security.InsecureFunction
             $code = 'attr_' . ($code ?: substr(md5(time()), 0, 8));
         }
         return $code;

app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php

@@ -213,7 +213,7 @@ public function validate($processingParams, $option)
                 }
             }
 
-            $fileHash = md5($tmpDirectory->readFile($tmpDirectory->getRelativePath($fileInfo['tmp_name'])));
+            $fileHash = hash('sha256', $tmpDirectory->readFile($tmpDirectory->getRelativePath($fileInfo['tmp_name'])));
 
             $userValue = [
                 'type' => $fileInfo['type'],

app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorInfo.php

@@ -125,7 +125,7 @@ public function validate($optionValue, $option)
      */
     protected function buildSecretKey($fileRelativePath)
     {
-        return substr(md5($this->rootDirectory->readFile($fileRelativePath)), 0, 20);
+        return substr(hash('sha256', $this->rootDirectory->readFile($fileRelativePath)), 0, 20);
     }
 
     /**

app/code/Magento/Catalog/Model/Webapi/Product/Option/Type/File/Processor.php

@@ -59,7 +59,7 @@ public function processFileContent(ImageContentInterface $imageContent)
         $filePath = $this->saveFile($imageContent);
 
         $fileAbsolutePath = $this->filesystem->getDirectoryRead(DirectoryList::MEDIA)->getAbsolutePath($filePath);
-        $fileHash = md5($this->filesystem->getDirectoryRead(DirectoryList::MEDIA)->readFile($filePath));
+        $fileHash = hash('sha256', $this->filesystem->getDirectoryRead(DirectoryList::MEDIA)->readFile($filePath));
         $imageSize = getimagesize($fileAbsolutePath);
         $result = [
             'type' => $imageContent->getType(),

app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/edit/serializer.phtml

@@ -8,7 +8,11 @@
 ?>
 
 // phpcs:disable Magento2.Security.InsecureFunction.DiscouragedWithAlternative
-<?php $_id = 'id_' . md5(microtime()) ?>
+<?php
+// md5() here is not for cryptographic use.
+// phpcs:ignore Magento2.Security.InsecureFunction
+$_id = 'id_' . md5(microtime())
+?>
 <input type="hidden"
        name="<?= $block->escapeHtmlAttr($block->getInputElementName()) ?>"
        value=""