Linter: gosec, Rule: G401 - Detect the usage of DES, RC4, MD5 or SHA1. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G401 - Detect the usage of DES, RC4, MD5 or SHA1

Rule is mapped to CWE-326: Inadequate Encryption Strength.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule following findings were found in current code:

plugins/inputs/filestat/filestat.go:127:10  gosec  G401: Use of weak cryptographic primitive

Additional info

For this rule no additional configuration can be provided.

[powersj]

+1