diff --git a/sdk/storage/azure-storage-blob/azure/storage/blob/_shared/validation.py b/sdk/storage/azure-storage-blob/azure/storage/blob/_shared/validation.py index 7161a31bb15e..5d31476fc478 100644 --- a/sdk/storage/azure-storage-blob/azure/storage/blob/_shared/validation.py +++ b/sdk/storage/azure-storage-blob/azure/storage/blob/_shared/validation.py @@ -77,7 +77,7 @@ def is_crc64_validation( def calculate_content_md5(data: Union[bytes, IO[bytes]]) -> bytes: - md5 = hashlib.md5() # nosec + md5 = hashlib.md5(usedforsecurity=False) # nosec if isinstance(data, bytes): md5.update(data) elif hasattr(data, "read"): diff --git a/sdk/storage/azure-storage-blob/tests/test_content_validation.py b/sdk/storage/azure-storage-blob/tests/test_content_validation.py index bc7633b087d3..802272a6ac68 100644 --- a/sdk/storage/azure-storage-blob/tests/test_content_validation.py +++ b/sdk/storage/azure-storage-blob/tests/test_content_validation.py @@ -18,6 +18,20 @@ from azure.core.exceptions import ResourceExistsError from azure.storage.blob import BlobBlock, BlobClient, BlobServiceClient, BlobType, ContainerClient +from azure.storage.blob._shared import validation + + +def test_content_md5_is_not_used_for_security(monkeypatch): + original_md5 = validation.hashlib.md5 + + def fips_md5(*args, **kwargs): + if kwargs.get("usedforsecurity") is not False: + raise ValueError("MD5 is unavailable for security use") + return original_md5(*args, **kwargs) + + monkeypatch.setattr(validation.hashlib, "md5", fips_md5) + + assert validation.calculate_content_md5(b"test") == bytes.fromhex("098f6bcd4621d373cade4e832627b4f6") def assert_content_md5(request): diff --git a/sdk/storage/azure-storage-file-datalake/azure/storage/filedatalake/_shared/validation.py b/sdk/storage/azure-storage-file-datalake/azure/storage/filedatalake/_shared/validation.py index 7161a31bb15e..5d31476fc478 100644 --- a/sdk/storage/azure-storage-file-datalake/azure/storage/filedatalake/_shared/validation.py +++ b/sdk/storage/azure-storage-file-datalake/azure/storage/filedatalake/_shared/validation.py @@ -77,7 +77,7 @@ def is_crc64_validation( def calculate_content_md5(data: Union[bytes, IO[bytes]]) -> bytes: - md5 = hashlib.md5() # nosec + md5 = hashlib.md5(usedforsecurity=False) # nosec if isinstance(data, bytes): md5.update(data) elif hasattr(data, "read"): diff --git a/sdk/storage/azure-storage-file-share/azure/storage/fileshare/_shared/validation.py b/sdk/storage/azure-storage-file-share/azure/storage/fileshare/_shared/validation.py index 7161a31bb15e..5d31476fc478 100644 --- a/sdk/storage/azure-storage-file-share/azure/storage/fileshare/_shared/validation.py +++ b/sdk/storage/azure-storage-file-share/azure/storage/fileshare/_shared/validation.py @@ -77,7 +77,7 @@ def is_crc64_validation( def calculate_content_md5(data: Union[bytes, IO[bytes]]) -> bytes: - md5 = hashlib.md5() # nosec + md5 = hashlib.md5(usedforsecurity=False) # nosec if isinstance(data, bytes): md5.update(data) elif hasattr(data, "read"): diff --git a/sdk/storage/azure-storage-queue/azure/storage/queue/_shared/validation.py b/sdk/storage/azure-storage-queue/azure/storage/queue/_shared/validation.py index 7161a31bb15e..5d31476fc478 100644 --- a/sdk/storage/azure-storage-queue/azure/storage/queue/_shared/validation.py +++ b/sdk/storage/azure-storage-queue/azure/storage/queue/_shared/validation.py @@ -77,7 +77,7 @@ def is_crc64_validation( def calculate_content_md5(data: Union[bytes, IO[bytes]]) -> bytes: - md5 = hashlib.md5() # nosec + md5 = hashlib.md5(usedforsecurity=False) # nosec if isinstance(data, bytes): md5.update(data) elif hasattr(data, "read"):