Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.
Why this matters
MD5 and SHA-1 are cryptographically broken: practical collision attacks exist, so they must NOT be used for any security purpose: integrity checks, content/token fingerprints, digital signatures, HMAC keys, or deduplication that a trust decision depends on (CWE-328 / CWE-327).
Use SHA-256 or stronger (SHA-384, SHA-512, SHA-3): MessageDigest.getInstance("SHA-256"). Note: this rule covers the general weak-digest case; storing passwords needs a dedicated slow hasher (BCrypt/Argon2/PBKDF2), which is enforced separately.
VULNERABLE
vulnerable.java
import java.security.MessageDigest;import java.security.NoSuchAlgorithmException;class WeakHash { // Integrity fingerprint over file bytes with a broken digest. byte[] md5Checksum(byte[] data) throws NoSuchAlgorithmException { // ruleid: auth.java.crypto.weak-hash MessageDigest md = MessageDigest.getInstance("MD5"); return md.digest(data); } // SHA-1 used to fingerprint a token / sign content — collision-prone. byte[] sha1TokenFingerprint(byte[] token) throws NoSuchAlgorithmException { // ruleid: auth.java.crypto.weak-hash MessageDigest md = MessageDigest.getInstance("SHA-1"); return md.digest(token); } // The hyphenless "SHA1" alias is the same broken algorithm. byte[] sha1Alias(byte[] data) throws NoSuchAlgorithmException { // ruleid: auth.java.crypto.weak-hash MessageDigest md = MessageDigest.getInstance("SHA1"); return md.digest(data); }}
If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.