Linter: gosec, Rule: G501 - Import blocklist: crypto/md5. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G501 - Import blocklist: crypto/md5

Rule is mapped to CWE-327: Use of a Broken or Risky Cryptographic Algorithm.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule following findings were found in current code:

plugins/inputs/filestat/filestat.go:5:2  gosec  G501: Blocklisted import crypto/md5: weak cryptographic primitive

Additional info

For this rule no additional configuration can be provided.

[powersj]

+1

[srebhan]

+1 until we hit a industry-control software that mixes CRC32 with MD5 for authentication. ;-)