Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion task_database.py
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@

from __future__ import annotations

import hashlib
import json
import os
import sqlite3
Expand Down Expand Up @@ -101,7 +102,10 @@
get = payload.get
task_id = get("id") or get("taskId") or get("uid") or get("_id")
if task_id is None:
task_id = hash(json.dumps(payload, sort_keys=True))
# Bug fix: Use a stable SHA1 hash of the JSON payload
# to ensure the ID is deterministic.
payload_bytes = json.dumps(payload, sort_keys=True).encode("utf-8")
task_id = hashlib.sha1(payload_bytes).hexdigest()

Check warning on line 108 in task_database.py

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

task_database.py#L108

Detected SHA1 hash algorithm which is considered insecure.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

While SHA1 is sufficient for generating a unique ID in this context, it is considered a legacy algorithm with known theoretical weaknesses. For better future-proofing and to align with current cryptographic best practices, consider using a more modern hash function from the SHA-2 family, such as SHA-256. This change would also require updating the expected hash value in the corresponding test.

Suggested change
task_id = hashlib.sha1(payload_bytes).hexdigest()
task_id = hashlib.sha256(payload_bytes).hexdigest()

task_id = str(task_id)

title = (
Expand Down
29 changes: 29 additions & 0 deletions tests/test_task_database.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
import unittest
import json

Check warning on line 2 in tests/test_task_database.py

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

tests/test_task_database.py#L2

'json' imported but unused (F401)

Check warning on line 2 in tests/test_task_database.py

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

tests/test_task_database.py#L2

Unused import json
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The json module is imported but not used in this file. Removing unused imports is recommended by PEP 8 to keep the code clean and avoid confusion.1

Style Guide References

Footnotes

  1. PEP 8 recommends removing unused imports to improve code readability and maintainability. This is often flagged by linters with codes like F401.

from task_database import TaskDatabase

class TestTaskDatabase(unittest.TestCase):

def setUp(self):
self.db = TaskDatabase(db_path=":memory:")

def test_normalise_task_generates_stable_id(self):
"""
Verify that _normalise_task generates a predictable, stable SHA1 hash
for a task payload that does not have an explicit ID.
"""
payload = {
"name": "Test Task",
"description": "A description for the test task.",
"status": "pending"
}
# The expected ID is the SHA1 hash of the sorted JSON payload.
# This has been corrected to match the actual output of hashlib.sha1.
expected_id = "a5b0c8d49a4c19a78200530eccd3caf4f859e5b5"

normalized_task = self.db._normalise_task(payload, "2023-10-27T10:00:00Z")

self.assertEqual(normalized_task["task_id"], expected_id)

if __name__ == "__main__":
unittest.main()