Linter: gosec, Rule: G506 - Import blocklist: golang.org/x/crypto/md4. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G506 - Import blocklist: golang.org/x/crypto/md4

Rule is mapped to CWE-327: Use of Weak Hash.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule no findings were found in current code.

Additional info

For this rule no additional configuration can be provided.

[zak-pawel]

I would enable it.

[srebhan]

What's the difference to rule 406 (#15800)?

[zak-pawel]

406 detects usages, 506 detects imports. I don't know why they are separated...

[srebhan]

I think we cannot use it if we don't import it and vice versa without triggering compiler errors or other linters. So I would say we do the one or the other not both. What do you think?

[zak-pawel]

It seems then that banning the import makes more sense. Although I don't see any objections to enabling both. :)

[srebhan]

See my comment in the other issue...