CU-86b14j4e0_check-code-security-reports-at-GitHub-for-all-repos

src/main/java/com/prowidesoftware/swift/model/SwiftMessageUtils.java

@@ -353,7 +353,7 @@ public static String identifier(final SwiftMessage m) {
     /**
      * Proprietary checksum for message integrity verification or duplicates detection.
      * <p>Please notice <strong>this is not the SWIFT trailer CHK field</strong>.
-     * <p>The implementation computes an MD5 on the complete message in FIN format. The result hash
+     * <p>The implementation computes an SHA-256 on the complete message in FIN format. The result hash
      * is a 32 character string, you may consider encoding it with base64 on top to have the same
      * information stored in 22 characters.
      *
@@ -365,7 +365,7 @@ public static String calculateChecksum(final SwiftMessage model) {
             final StringWriter writer = new StringWriter();
             SwiftWriter.writeMessage(model, writer, true);
             final String fin = writer.getBuffer().toString();
-            return md5(fin);
+            return sha256(fin);
         } else {
             return null;
         }
@@ -374,7 +374,7 @@ public static String calculateChecksum(final SwiftMessage model) {
     /**
      * Proprietary checksum for message text block (block 4) integrity verification or duplicates detection
      * <p>Please notice <strong>this is not the SWIFT trailer CHK field</strong>.
-     * <p>The implementation computes an MD5 on the complete message in FIN format. The result hash
+     * <p>The implementation computes an SHA-256 on the complete message in FIN format. The result hash
      * is a 32 character string, you may consider encoding it with base64 on top to have the same
      * information stored in 22 characters.
      *
@@ -387,24 +387,22 @@ public static String calculateChecksum(final SwiftBlock4 b4) {
             final StringWriter writer = new StringWriter();
             SwiftWriter.writeBlock4(b4, writer);
             final String fin = writer.getBuffer().toString();
-            return md5(fin);
+            return sha256(fin);
         } else {
             return null;
         }
     }
 
     /**
-     * Computes an MD5 hash on the parameter text
+     * Computes a SHA-256 hash on the parameter text
      *
      * @param text the text to hash
      * @return computed hash or null if exceptions are thrown reading bytes or processing the digest
-     * @since 7.9.5
      */
-    // TODO add base 64 encoding on top when upgraded to Java 8
-    private static String md5(final String text) {
+    private static String sha256(final String text) {
         try {
             byte[] bytesOfMessage = text.getBytes(StandardCharsets.UTF_8);
-            MessageDigest md = MessageDigest.getInstance("MD5");
+            MessageDigest md = MessageDigest.getInstance("SHA-256");
             byte[] thedigest = md.digest(bytesOfMessage);
 
             // Converting the bytes to a Hex string