mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-24 10:08:00 -06:00
Dylan M. Taylor
bd9030b271
vendor/ is third-party code kept close to upstream (vendor/README.md), so SonarCloud's 186 findings there are not ours to restyle. MD5 in crates/crypt is what ISO 32000's standard security handler mandates, and RIPEMD-160 in crates/sign is a digest existing signatures can name; both S4790 findings are scoped to those two files.
17 lines
957 B
Properties
17 lines
957 B
Properties
sonar.projectKey=storytold_pdfcraft
|
|
sonar.organization=storytold
|
|
|
|
# vendor/ holds third-party crates carried with small, marked patches (vendor/README.md).
|
|
# They are kept close to upstream so each copy can be dropped once upstream releases the
|
|
# fix; restyling them would only make that harder, so they are not analysed here.
|
|
sonar.exclusions=vendor/**
|
|
|
|
# S4790 (weak hash): MD5 is the hash ISO 32000 mandates for the RC4/AES-128 standard security
|
|
# handler (Algorithms 1-5), and RIPEMD-160 is a digest existing signatures may name. Both are
|
|
# needed to open and verify existing files, not chosen for new security.
|
|
sonar.issue.ignore.multicriteria=crypt_md5,sign_ripemd
|
|
sonar.issue.ignore.multicriteria.crypt_md5.ruleKey=rust:S4790
|
|
sonar.issue.ignore.multicriteria.crypt_md5.resourceKey=crates/crypt/src/lib.rs
|
|
sonar.issue.ignore.multicriteria.sign_ripemd.ruleKey=rust:S4790
|
|
sonar.issue.ignore.multicriteria.sign_ripemd.resourceKey=crates/sign/src/keys.rs
|