Skip to content

Webpack Hash is not FIPS-Compliant #13572

@BurntCoffee543

Description

@BurntCoffee543

Bug report

What is the current behavior?
Building on a FIPS-enabled system, the digest "md4" is not supported (and furthermore is not FIPS-compliant). Upon building, the following error is thrown...

UnhandledPromiseRejectionWarning: Error: Digest method not supported
    at new Hash (internal/crypto/hash.js:46:19)
    at Object.createHash (crypto.js:115:10)
    at module.exports (omitted_root_path/node_modules/webpack/lib/util/createHash.js:135:53)
    at ConcatenatedModule._createIdentifier (omitted_root_path/node_modules/webpack/lib/optimize/ConcatenatedModule.js:563:16)
    at new ConcatenatedModule (omitted_root_path/node_modules/webpack/lib/optimize/ConcatenatedModule.js:445:27)

The issue is that some of the modules have "md4" hardcoded in (unconfigurable) such as the ConcatenatedModule.

If the current behavior is a bug, please provide the steps to reproduce.
I cannot easily link a StackBlitz or GitHub repo as fips has to be enabled on the Node distribution. The following is the custom-webpack config...

const webpack = require('webpack');
 
module.exports = {
  output: {
    hashFunction: 'sha256'
  },
  plugins: [
    new webpack.HashedModuleIdsPlugin({
      hashFunction: 'sha256'
    })
  ]
};

What is the expected behavior?
For any use of a hash, there should be option to configure the underlying algorithm via the custom-webpack config. This StackOverflow post suggests a workaround of disabling the ConcatenatedModule, but any hardcoded hashing algorithm should be configurable so that they can run on FIPS-enabled systems.

Other relevant information:
webpack version: 4.44.2
Node.js version: 14.16.0
Operating System: RHEL

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions