Merge pull request #54954 from nextcloud/refactor/md5

2026-04-22 23:03:00 -04:00 · 2025-09-09 07:44:50 +02:00 · 2025-09-09 07:44:50 +02:00 · 6d9828dec0
commit 6d9828dec0
parent 266a349d0c 3844927f8f
7 changed files with 297 additions and 45 deletions
--- a/core/src/globals.js
+++ b/core/src/globals.js
@ -18,7 +18,6 @@ import Backbone from 'backbone'
 import ClipboardJS from 'clipboard'
 import { dav } from 'davclient.js'
 import Handlebars from 'handlebars'
-import md5 from 'blueimp-md5'
 import moment from 'moment'
 import 'select2'
 import 'select2/select2.css'
@ -81,8 +80,6 @@ setDeprecatedProp('Backbone', () => Backbone, 'please ship your own, this will b
 setDeprecatedProp(['Clipboard', 'ClipboardJS'], () => ClipboardJS, 'please ship your own, this will be removed in Nextcloud 20')
 window.dav = dav
 setDeprecatedProp('Handlebars', () => Handlebars, 'please ship your own, this will be removed in Nextcloud 20')
-// Global md5 only required for: apps/files/js/file-upload.js
-setDeprecatedProp('md5', () => md5, 'please ship your own, this will be removed in Nextcloud 20')
 setDeprecatedProp('moment', () => moment, 'please ship your own, this will be removed in Nextcloud 20')

 window.OC = OC
--- a/core/src/jquery/placeholder.js
+++ b/core/src/jquery/placeholder.js
@ -1,12 +1,13 @@
+/* eslint-disable jsdoc/require-jsdoc */
+/* eslint-disable no-extend-native */
 /**
 * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
 * SPDX-FileCopyrightText: 2013-2016 ownCloud, Inc.
 * SPDX-License-Identifier: AGPL-3.0-or-later
 */

-/* eslint-disable */
+import { createHash } from 'crypto-browserify'
 import $ from 'jquery'
-import md5 from 'blueimp-md5'

 /*
 * Adds a background color to the element called on and adds the first character
@ -42,17 +43,19 @@ import md5 from 'blueimp-md5'
 *
 * Will return the rgb parameters within the following object:
 *
-* Color {r: 208, g: 158, b: 109}
+* Color {r: 208, g: 158, b: 109}
 *
 */

 const toRgb = (s) => {
 	// Normalize hash
-	var hash = s.toLowerCase()
+	let hash = s.toLowerCase()

 	// Already a md5 hash?
 	if (hash.match(/^([0-9a-f]{4}-?){8}$/) === null) {
-		hash = md5(hash)
+		createHash('md5')
+			.update(hash)
+			.digest('hex')
 	}

 	hash = hash.replace(/[^0-9a-f]/g, '')
@ -64,7 +67,7 @@ const toRgb = (s) => {
 	}

 	function stepCalc(steps, ends) {
-		var step = new Array(3)
+		const step = new Array(3)
 		step[0] = (ends[1].r - ends[0].r) / steps
 		step[1] = (ends[1].g - ends[0].g) / steps
 		step[2] = (ends[1].b - ends[0].b) / steps
@ -72,43 +75,43 @@ const toRgb = (s) => {
 	}

 	function mixPalette(steps, color1, color2) {
-		var palette = []
+		const palette = []
 		palette.push(color1)
-		var step = stepCalc(steps, [color1, color2])
-		for (var i = 1; i < steps; i++) {
-			var r = parseInt(color1.r + (step[0] * i))
-			var g = parseInt(color1.g + (step[1] * i))
-			var b = parseInt(color1.b + (step[2] * i))
+		const step = stepCalc(steps, [color1, color2])
+		for (let i = 1; i < steps; i++) {
+			const r = parseInt(color1.r + (step[0] * i))
+			const g = parseInt(color1.g + (step[1] * i))
+			const b = parseInt(color1.b + (step[2] * i))
 			palette.push(new Color(r, g, b))
 		}
 		return palette
 	}

-	const red = new Color(182, 70, 157);
-	const yellow = new Color(221, 203, 85);
-	const blue = new Color(0, 130, 201); // Nextcloud blue
+	const red = new Color(182, 70, 157)
+	const yellow = new Color(221, 203, 85)
+	const blue = new Color(0, 130, 201) // Nextcloud blue
 	// Number of steps to go from a color to another
 	// 3 colors * 6 will result in 18 generated colors
-	const steps = 6;
+	const steps = 6

-	const palette1 = mixPalette(steps, red, yellow);
-	const palette2 = mixPalette(steps, yellow, blue);
-	const palette3 = mixPalette(steps, blue, red);
+	const palette1 = mixPalette(steps, red, yellow)
+	const palette2 = mixPalette(steps, yellow, blue)
+	const palette3 = mixPalette(steps, blue, red)

-	const finalPalette = palette1.concat(palette2).concat(palette3);
+	const finalPalette = palette1.concat(palette2).concat(palette3)

 	// Convert a string to an integer evenly
 	function hashToInt(hash, maximum) {
-		var finalInt = 0
-		var result = []
+		let finalInt = 0
+		const result = []

 		// Splitting evenly the string
-		for (var i = 0; i < hash.length; i++) {
+		for (let i = 0; i < hash.length; i++) {
 			// chars in md5 goes up to f, hex:16
 			result.push(parseInt(hash.charAt(i), 16) % 16)
 		}
 		// Adds up all results
-		for (var j in result) {
+		for (const j in result) {
 			finalInt += result[j]
 		}
 		// chars in md5 goes up to f, hex:16
@ -129,11 +132,11 @@ $.fn.imageplaceholder = function(seed, text, size) {
 	text = text || seed

 	// Compute the hash
-	var rgb = toRgb(seed)
+	const rgb = toRgb(seed)
 	this.css('background-color', 'rgb(' + rgb.r + ', ' + rgb.g + ', ' + rgb.b + ')')

 	// Placeholders are square
-	var height = this.height() || size || 32
+	const height = this.height() || size || 32
 	this.height(height)
 	this.width(height)

@ -147,8 +150,8 @@ $.fn.imageplaceholder = function(seed, text, size) {
 	this.css('font-size', (height * 0.55) + 'px')

 	if (seed !== null && seed.length) {
-		var placeholderText = text.replace(/\s+/g, ' ').trim().split(' ', 2).map((word) => word[0].toUpperCase()).join('')
-		this.html(placeholderText);
+		const placeholderText = text.replace(/\s+/g, ' ').trim().split(' ', 2).map((word) => word[0].toUpperCase()).join('')
+		this.html(placeholderText)
 	}
 }

--- a/dist/core-main.js
+++ b/dist/core-main.js
--- a/dist/core-main.js.license
+++ b/dist/core-main.js.license
@ -5,50 +5,71 @@ SPDX-License-Identifier: BSD-3-Clause
 SPDX-License-Identifier: Apache-2.0
 SPDX-License-Identifier: AGPL-3.0-or-later
 SPDX-License-Identifier: (MPL-2.0 OR Apache-2.0)
+SPDX-License-Identifier: (MIT AND BSD-3-Clause)
 SPDX-FileCopyrightText: string_decoder developers
+SPDX-FileCopyrightText: ripemd160 developers
+SPDX-FileCopyrightText: readable-stream developers
 SPDX-FileCopyrightText: inherits developers
 SPDX-FileCopyrightText: escape-html developers
 SPDX-FileCopyrightText: debounce developers
 SPDX-FileCopyrightText: clipboard developers
+SPDX-FileCopyrightText: browserify-sign developers
+SPDX-FileCopyrightText: browserify-rsa developers
 SPDX-FileCopyrightText: Yehuda Katz
 SPDX-FileCopyrightText: Varun A P
 SPDX-FileCopyrightText: Tobias Koppers @sokra
 SPDX-FileCopyrightText: Titus Wormer <tituswormer@gmail.com> (https://wooorm.com)
 SPDX-FileCopyrightText: T. Jameson Little <t.jameson.little@gmail.com>
-SPDX-FileCopyrightText: Sebastian Tschan
 SPDX-FileCopyrightText: Roman Shtylman <shtylman@gmail.com>
 SPDX-FileCopyrightText: Roeland Jago Douma
 SPDX-FileCopyrightText: Rob Cresswell <robcresswell@pm.me>
+SPDX-FileCopyrightText: Raynos <raynos2@gmail.com>
 SPDX-FileCopyrightText: Paul Vorbach <paul@vorba.ch> (http://paul.vorba.ch)
 SPDX-FileCopyrightText: Paul Vorbach <paul@vorb.de> (http://vorb.de)
 SPDX-FileCopyrightText: OpenJS Foundation and other contributors
 SPDX-FileCopyrightText: Nextcloud GmbH and Nextcloud contributors
+SPDX-FileCopyrightText: Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)
 SPDX-FileCopyrightText: Morris Jobke
 SPDX-FileCopyrightText: Matt Zabriskie
+SPDX-FileCopyrightText: Mathias Buus (@mafintosh)
+SPDX-FileCopyrightText: Kirill Fomichev <fanatid@ya.ru> (https://github.com/fanatid)
+SPDX-FileCopyrightText: Julian Gruber
 SPDX-FileCopyrightText: Joyent
+SPDX-FileCopyrightText: Jordan Harband <ljharb@gmail.com>
+SPDX-FileCopyrightText: Jordan Harband
 SPDX-FileCopyrightText: Jonas Schade <derzade@gmail.com>
 SPDX-FileCopyrightText: Joey Andres
 SPDX-FileCopyrightText: Jeremy Ashkenas <jeremy@documentcloud.org>
 SPDX-FileCopyrightText: Jeremy Ashkenas
+SPDX-FileCopyrightText: James Halliday
 SPDX-FileCopyrightText: Jacob Clevenger<https://github.com/wheatjs>
 SPDX-FileCopyrightText: Iskren Ivov Chernev <iskren.chernev@gmail.com> (https://github.com/ichernev)
+SPDX-FileCopyrightText: Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)
+SPDX-FileCopyrightText: Irakli Gozalishvili <rfobic@gmail.com> (http://jeditoolkit.com)
 SPDX-FileCopyrightText: Igor Vaynberg
 SPDX-FileCopyrightText: Guillaume Chau <guillaume.b.chau@gmail.com>
 SPDX-FileCopyrightText: GitHub Inc.
 SPDX-FileCopyrightText: Feross Aboukhadijeh
+SPDX-FileCopyrightText: Fedor Indutny <fedor@indutny.com>
+SPDX-FileCopyrightText: Fedor Indutny
 SPDX-FileCopyrightText: Evert Pot
 SPDX-FileCopyrightText: Evan You
 SPDX-FileCopyrightText: Eugene Sharygin <eush77@gmail.com>
 SPDX-FileCopyrightText: Eric Norris (https://github.com/ericnorris)
 SPDX-FileCopyrightText: Dr.-Ing. Mario Heiderich, Cure53 <mario@cure53.de> (https://cure53.de/)
+SPDX-FileCopyrightText: Dominic Tarr <dominic.tarr@gmail.com> (dominictarr.com)
 SPDX-FileCopyrightText: Denis Pushkarev
 SPDX-FileCopyrightText: David Clark
+SPDX-FileCopyrightText: Daniel Cousens
 SPDX-FileCopyrightText: Christoph Wurst
+SPDX-FileCopyrightText: Calvin Metcalf <calvin.metcalf@gmail.com>
+SPDX-FileCopyrightText: Calvin Metcalf
 SPDX-FileCopyrightText: Ben Newman <bn@cs.stanford.edu>
 SPDX-FileCopyrightText: Austin Andrews
 SPDX-FileCopyrightText: Anthony Fu <https://github.com/antfu>
 SPDX-FileCopyrightText: Alkemics
 SPDX-FileCopyrightText: @nextcloud/dialogs developers
+SPDX-FileCopyrightText: 


 This file is generated from multiple sources. Included packages:
@ -124,6 +145,15 @@ This file is generated from multiple sources. Included packages:
 - @vueuse/shared
 	- version: 11.3.0
 	- license: MIT
+- bn.js
+	- version: 4.12.2
+	- license: MIT
+- asn1.js
+	- version: 4.10.1
+	- license: MIT
+- available-typed-arrays
+	- version: 1.0.7
+	- license: MIT
 - axios
 	- version: 1.11.0
 	- license: MIT
@ -133,27 +163,78 @@ This file is generated from multiple sources. Included packages:
 - base64-js
 	- version: 1.5.1
 	- license: MIT
- blueimp-md5
-	- version: 2.19.0
+- bn.js
+	- version: 5.2.2
+	- license: MIT
+- brorand
+	- version: 1.1.0
+	- license: MIT
+- browserify-aes
+	- version: 1.2.0
+	- license: MIT
+- browserify-cipher
+	- version: 1.0.1
+	- license: MIT
+- browserify-des
+	- version: 1.0.2
+	- license: MIT
+- browserify-rsa
+	- version: 4.1.1
+	- license: MIT
+- browserify-sign
+	- version: 4.2.3
+	- license: ISC
+- buffer-xor
+	- version: 1.0.3
 	- license: MIT
 - buffer
 	- version: 5.7.1
 	- license: MIT
+- call-bind-apply-helpers
+	- version: 1.0.2
+	- license: MIT
+- call-bind
+	- version: 1.0.8
+	- license: MIT
+- call-bound
+	- version: 1.0.4
+	- license: MIT
 - cancelable-promise
 	- version: 4.3.1
 	- license: MIT
 - charenc
 	- version: 0.0.2
 	- license: BSD-3-Clause
+- cipher-base
+	- version: 1.0.6
+	- license: MIT
 - clipboard
 	- version: 2.0.11
 	- license: MIT
 - core-js
 	- version: 3.45.1
 	- license: MIT
+- core-util-is
+	- version: 1.0.3
+	- license: MIT
+- bn.js
+	- version: 4.12.2
+	- license: MIT
+- create-ecdh
+	- version: 4.0.4
+	- license: MIT
+- create-hash
+	- version: 1.2.0
+	- license: MIT
+- create-hmac
+	- version: 1.1.7
+	- license: MIT
 - crypt
 	- version: 0.0.2
 	- license: BSD-3-Clause
+- crypto-browserify
+	- version: 3.12.1
+	- license: MIT
 - css-loader
 	- version: 7.1.2
 	- license: MIT
@ -163,42 +244,147 @@ This file is generated from multiple sources. Included packages:
 - debounce
 	- version: 2.2.0
 	- license: MIT
+- define-data-property
+	- version: 1.1.4
+	- license: MIT
+- des.js
+	- version: 1.1.0
+	- license: MIT
+- bn.js
+	- version: 4.12.2
+	- license: MIT
+- diffie-hellman
+	- version: 5.0.3
+	- license: MIT
 - dompurify
 	- version: 3.2.6
 	- license: (MPL-2.0 OR Apache-2.0)
+- dunder-proto
+	- version: 1.0.1
+	- license: MIT
+- bn.js
+	- version: 4.12.2
+	- license: MIT
+- elliptic
+	- version: 6.6.1
+	- license: MIT
+- es-define-property
+	- version: 1.0.1
+	- license: MIT
+- es-errors
+	- version: 1.3.0
+	- license: MIT
+- es-object-atoms
+	- version: 1.1.1
+	- license: MIT
 - escape-html
 	- version: 1.0.3
 	- license: MIT
+- events
+	- version: 3.3.0
+	- license: MIT
+- evp_bytestokey
+	- version: 1.0.3
+	- license: MIT
 - floating-vue
 	- version: 1.0.0-beta.19
 	- license: MIT
 - focus-trap
 	- version: 7.6.5
 	- license: MIT
+- for-each
+	- version: 0.3.5
+	- license: MIT
+- function-bind
+	- version: 1.1.2
+	- license: MIT
+- get-intrinsic
+	- version: 1.3.0
+	- license: MIT
+- get-proto
+	- version: 1.0.1
+	- license: MIT
+- gopd
+	- version: 1.2.0
+	- license: MIT
 - handlebars
 	- version: 4.7.8
 	- license: MIT
+- has-property-descriptors
+	- version: 1.0.2
+	- license: MIT
+- has-symbols
+	- version: 1.1.0
+	- license: MIT
+- has-tostringtag
+	- version: 1.0.2
+	- license: MIT
+- hash-base
+	- version: 3.0.5
+	- license: MIT
+- hash.js
+	- version: 1.1.7
+	- license: MIT
+- hasown
+	- version: 2.0.2
+	- license: MIT
+- hmac-drbg
+	- version: 1.0.1
+	- license: MIT
 - ieee754
 	- version: 1.2.1
 	- license: BSD-3-Clause
+- inherits
+	- version: 2.0.4
+	- license: ISC
 - is-buffer
 	- version: 1.1.6
 	- license: MIT
+- is-callable
+	- version: 1.2.7
+	- license: MIT
+- is-typed-array
+	- version: 1.1.15
+	- license: MIT
+- isarray
+	- version: 1.0.0
+	- license: MIT
 - jquery-ui-dist
 	- version: 1.13.3
 	- license: MIT
 - jquery
 	- version: 3.7.1
 	- license: MIT
+- math-intrinsics
+	- version: 1.1.0
+	- license: MIT
+- md5.js
+	- version: 1.3.5
+	- license: MIT
 - md5
 	- version: 2.3.0
 	- license: BSD-3-Clause
+- bn.js
+	- version: 4.12.2
+	- license: MIT
+- miller-rabin
+	- version: 4.0.1
+	- license: MIT
+- minimalistic-assert
+	- version: 1.0.1
+	- license: ISC
+- minimalistic-crypto-utils
+	- version: 1.0.1
+	- license: MIT
 - moment
 	- version: 2.30.1
 	- license: MIT
 - buffer
 	- version: 6.0.3
 	- license: MIT
+- parse-asn1
+	- version: 5.1.7
+	- license: ISC
 - inherits
 	- version: 2.0.3
 	- license: ISC
@ -208,21 +394,75 @@ This file is generated from multiple sources. Included packages:
 - path
 	- version: 0.12.7
 	- license: MIT
+- create-hash
+	- version: 1.1.3
+	- license: MIT
+- hash-base
+	- version: 2.0.2
+	- license: MIT
+- ripemd160
+	- version: 2.0.1
+	- license: MIT
+- pbkdf2
+	- version: 3.1.3
+	- license: MIT
+- possible-typed-array-names
+	- version: 1.1.0
+	- license: MIT
+- process-nextick-args
+	- version: 2.0.1
+	- license: MIT
 - process
 	- version: 0.11.10
 	- license: MIT
+- bn.js
+	- version: 4.12.2
+	- license: MIT
+- public-encrypt
+	- version: 4.0.3
+	- license: MIT
+- randombytes
+	- version: 2.1.0
+	- license: MIT
+- randomfill
+	- version: 1.0.4
+	- license: MIT
+- safe-buffer
+	- version: 5.1.2
+	- license: MIT
+- string_decoder
+	- version: 1.1.1
+	- license: MIT
+- readable-stream
+	- version: 2.3.8
+	- license: MIT
 - regenerator-runtime
 	- version: 0.14.1
 	- license: MIT
+- ripemd160
+	- version: 2.0.2
+	- license: MIT
 - safe-buffer
 	- version: 5.2.1
 	- license: MIT
 - select2
 	- version: 3.5.1
 	- license: MIT
+- set-function-length
+	- version: 1.2.2
+	- license: MIT
+- sha.js
+	- version: 2.4.12
+	- license: (MIT AND BSD-3-Clause)
 - snap.js
 	- version: 2.0.9
 	- license: ISC
+- readable-stream
+	- version: 3.6.2
+	- license: MIT
+- stream-browserify
+	- version: 3.0.0
+	- license: MIT
 - strengthify
 	- version: 0.5.9
 	- license: MIT
@ -238,9 +478,18 @@ This file is generated from multiple sources. Included packages:
 - tabbable
 	- version: 6.2.0
 	- license: MIT
+- isarray
+	- version: 2.0.5
+	- license: MIT
+- to-buffer
+	- version: 1.2.1
+	- license: MIT
 - toastify-js
 	- version: 1.12.0
 	- license: MIT
+- typed-array-buffer
+	- version: 1.0.3
+	- license: MIT
 - typescript-event-target
 	- version: 1.1.1
 	- license: MIT
@ -259,6 +508,12 @@ This file is generated from multiple sources. Included packages:
 - unist-util-visit
 	- version: 5.0.0
 	- license: MIT
+- util-deprecate
+	- version: 1.0.2
+	- license: MIT
+- vm-browserify
+	- version: 1.1.2
+	- license: MIT
 - vue-loader
 	- version: 15.11.1
 	- license: MIT
@ -271,6 +526,9 @@ This file is generated from multiple sources. Included packages:
 - webpack
 	- version: 5.101.3
 	- license: MIT
+- which-typed-array
+	- version: 1.1.19
+	- license: MIT
 - nextcloud
 	- version: 1.0.0
 	- license: AGPL-3.0-or-later
--- a/dist/core-main.js.map
+++ b/dist/core-main.js.map
--- a/package-lock.json
+++ b/package-lock.json
@ -37,7 +37,6 @@
        "@vueuse/core": "^11.3.0",
        "@vueuse/integrations": "^11.3.0",
        "backbone": "^1.6.1",
-        "blueimp-md5": "^2.19.0",
        "blurhash": "^2.0.5",
        "browserslist-useragent-regexp": "^4.1.3",
        "camelcase": "^8.0.0",
@ -45,6 +44,7 @@
        "clipboard": "^2.0.11",
        "color": "^5.0.0",
        "core-js": "^3.45.0",
+        "crypto-browserify": "^3.12.1",
        "davclient.js": "nextcloud-deps/davclient.js#59d7777d7fe290c5f1fd74a58e7eb529b63e153d",
        "debounce": "^2.2.0",
        "dompurify": "^3.2.6",
@ -8670,12 +8670,6 @@
      "dev": true,
      "license": "MIT"
    },
-    "node_modules/blueimp-md5": {
-      "version": "2.19.0",
-      "resolved": "https://registry.npmjs.org/blueimp-md5/-/blueimp-md5-2.19.0.tgz",
-      "integrity": "sha512-DRQrD6gJyy8FbiE4s+bDoXS9hiW3Vbx5uCdwvcCf3zLHL+Iv7LtGHLpr+GZV8rHG8tK766FGYBwRbu8pELTt+w==",
-      "license": "MIT"
-    },
    "node_modules/blurhash": {
      "version": "2.0.5",
      "resolved": "https://registry.npmjs.org/blurhash/-/blurhash-2.0.5.tgz",
--- a/package.json
+++ b/package.json
@ -68,7 +68,6 @@
    "@vueuse/core": "^11.3.0",
    "@vueuse/integrations": "^11.3.0",
    "backbone": "^1.6.1",
-    "blueimp-md5": "^2.19.0",
    "blurhash": "^2.0.5",
    "browserslist-useragent-regexp": "^4.1.3",
    "camelcase": "^8.0.0",
@ -76,6 +75,7 @@
    "clipboard": "^2.0.11",
    "color": "^5.0.0",
    "core-js": "^3.45.0",
+    "crypto-browserify": "^3.12.1",
    "davclient.js": "nextcloud-deps/davclient.js#59d7777d7fe290c5f1fd74a58e7eb529b63e153d",
    "debounce": "^2.2.0",
    "dompurify": "^3.2.6",