sonar-cryptography
sonar-cryptography copied to clipboard
Crypto detection in comment
When scanning pkg:maven/com.google.guava/[email protected] we get 12 findings all of which come from Hashing.java. All findings refer to locations at the closing '*/' of javadoc comments. One such example is Hashing.java#L364.
/**
* Returns a hash function implementing the Message Authentication Code (MAC) algorithm, using the
* SHA-512 (512 hash bits) hash function and the given secret key.
*
* @param key the secret key
* @throws IllegalArgumentException if the given key is inappropriate for initializing this MAC
* @since 20.0
*/
Does the SHA-512 string trigger the false positive?