From fce8069b185fbb1e5c6bfacfdbd3e28757a6f665 Mon Sep 17 00:00:00 2001
From: LIghtJUNction <lightjunction.me@gmail.com>
Date: Thu, 19 Mar 2026 17:40:09 +0800
Subject: [PATCH] Potential fix for code scanning alert no. 44: Use of a broken
 or weak cryptographic hashing algorithm on sensitive data

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 astrbot/cli/commands/cmd_conf.py | 21 +++++++++++++++++++--
 requirements.txt                 |  1 +
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/astrbot/cli/commands/cmd_conf.py b/astrbot/cli/commands/cmd_conf.py
index 75d6ed4b6..cc46ead98 100644
--- a/astrbot/cli/commands/cmd_conf.py
+++ b/astrbot/cli/commands/cmd_conf.py
@@ -5,6 +5,7 @@ from collections.abc import Callable
 from typing import Any
 
 import click
+from argon2 import PasswordHasher, exceptions as argon2_exceptions
 
 from astrbot.core.utils.astrbot_path import astrbot_paths
 
@@ -17,19 +18,35 @@ DEFAULT_DASHBOARD_PASSWORD = "astrbot"
 # Note: In a full implementation, salts should be unique per password.
 DASHBOARD_PASSWORD_SALT = b"astrbot-dashboard"
 DASHBOARD_PASSWORD_ITERATIONS = 200_000
+PASSWORD_HASHER = PasswordHasher()
 
 
 def hash_dashboard_password_secure(value: str) -> str:
-    """Securely hash a Dashboard password using PBKDF2-HMAC-SHA256."""
-    dk = hashlib.pbkdf2_hmac(
+    """Hash Dashboard password for storage.
         "sha256",
+    Uses Argon2 for new passwords to provide a computationally expensive,
+    salted hash suitable for password storage.
+    """
+    return PASSWORD_HASHER.hash(value)
         value.encode(),
+
         DASHBOARD_PASSWORD_SALT,
         DASHBOARD_PASSWORD_ITERATIONS,
     )
     return dk.hex()
 
 
+    """Return True if the value looks like a supported dashboard password hash.
+
+    Supports:
+    - Argon2 hashes (preferred, start with "$argon2")
+    - Legacy SHA-256 and MD5 hexadecimal digests.
+    """
+    # Argon2 hashes contain algorithm marker like `$argon2id$...`
+    if value.startswith("$argon2"):
+        return True
+
+    # Fallback to legacy hexadecimal digests
 # Legacy default password hashes kept for backward compatibility.
 DEFAULT_DASHBOARD_PASSWORD_MD5 = hashlib.md5(
     DEFAULT_DASHBOARD_PASSWORD.encode()
diff --git a/requirements.txt b/requirements.txt
index 48c4da809..2789bf549 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,5 @@
 # This file was autogenerated by uv via the following command:
+argon2-cffi==25.1.0
 #    uv export --no-hashes --output-file requirements.txt
 -e .
 aiocqhttp==1.4.4