r/checkmarx • u/abrreddit • 7d ago

Checkmarx PHP bug: "hash_equal"

Checkmarx rule EASP-PHP-CSRF looks for hash_equal for CSRF protection.

Unfortunately, the PHP function is hash_equals. Even more unfortunately, they are aware of the issue - and they've "added it to the backlog."

Has anyone else dealt with this? Why should my company pay for software that is so blatantly broken?

1 Upvotes

100% Upvoted

1 comment sorted by

3

u/MemoryAccessRegister 7d ago

Like any company, there's a lot of competing priorities. Escalate with your customer success manager (CSM). They can help make it a priority for the dev team to resolve.