Merge pull request #3745 from Pylons/phash-sha256

upgrade phash implementation from md5 to sha256

CHANGES.rst

@@ -22,6 +22,12 @@ Features
 
   See https://github.com/Pylons/pyramid/pull/3735
 
+- Replace usage of ``md5`` in the Pyramid view system with ``sha256``. This
+  is not a security-related feature and is considered an implementation detail
+  that should not impact users.
+
+  See https://github.com/Pylons/pyramid/pull/3745
+
 Bug Fixes
 ---------
 

src/pyramid/config/predicates.py

@@ -1,4 +1,4 @@
-from hashlib import md5
+from hashlib import sha256
 from webob.acceptparse import Accept
 
 from pyramid.exceptions import ConfigurationError
@@ -8,7 +8,7 @@
 from pyramid.util import TopologicalSorter, bytes_, is_nonstr_iter
 
 MAX_ORDER = 1 << 30
-DEFAULT_PHASH = md5().hexdigest()
+DEFAULT_PHASH = sha256().hexdigest()
 
 
 class PredicateConfiguratorMixin:
@@ -137,7 +137,7 @@ def make(self, config, **kw):
         # phash) that can be used by a caller to identify identical predicate
         # lists.
         ordered = self.sorter.sorted()
-        phash = md5()
+        phash = sha256()
         weights = []
         preds = []
         info = PredicateInfo(

tests/test_config/test_views.py

@@ -554,7 +554,7 @@ def test_add_view_exception_register_secured_view(self):
         self.assertEqual(wrapper, view)
 
     def test_add_view_same_phash_overrides_existing_single_view(self):
-        from hashlib import md5
+        from hashlib import sha256
         from zope.interface import Interface
 
         from pyramid.interfaces import (
@@ -565,7 +565,7 @@ def test_add_view_same_phash_overrides_existing_single_view(self):
         )
         from pyramid.renderers import null_renderer
 
-        phash = md5()
+        phash = sha256()
         phash.update(b'xhr = True')
         view = lambda *arg: 'NOT OK'
         view.__phash__ = phash.hexdigest()
@@ -585,7 +585,7 @@ def newview(context, request):
         self.assertEqual(wrapper(None, request), 'OK')
 
     def test_add_view_exc_same_phash_overrides_existing_single_view(self):
-        from hashlib import md5
+        from hashlib import sha256
         from zope.interface import implementedBy
 
         from pyramid.interfaces import (
@@ -596,7 +596,7 @@ def test_add_view_exc_same_phash_overrides_existing_single_view(self):
         )
         from pyramid.renderers import null_renderer
 
-        phash = md5()
+        phash = sha256()
         phash.update(b'xhr = True')
         view = lambda *arg: 'NOT OK'
         view.__phash__ = phash.hexdigest()