/**
 * Pass: weak-hash (CWE-328, category: security)
 *
 * Pattern pass — flags use of cryptographically broken hash algorithms
 * (MD2, MD4, MD5, SHA-1) for security purposes. The vulnerability is
 * the *constant algorithm string*, not data flow: `MessageDigest.getInstance("MD5")`
 * is always vulnerable regardless of input. Therefore this is implemented
 * as call-site literal inspection, not as a taint sink.
 *
 * Detection per language:
 *   Java:
 *     - `MessageDigest.getInstance("MD5"|"SHA-1"|"SHA1"|"MD2"|"MD4")`
 *     - `DigestUtils.md5(...)` / `md5Hex(...)` / `sha1(...)` / `sha1Hex(...)`
 *       (Apache Commons Codec — method name encodes the algorithm)
 *   Python:
 *     - `hashlib.md5(...)` / `hashlib.sha1(...)` / `hashlib.md4(...)` / `hashlib.new("md5", ...)`
 *   JavaScript / TypeScript:
 *     - `crypto.createHash('md5'|'sha1'|'md4'|'md2')`
 *     - `crypto.createHmac('md5'|'sha1', key)`
 *   Go:
 *     - `md5.New()` / `md5.Sum(...)` / `sha1.New()` / `sha1.Sum(...)`
 *       (from `crypto/md5` and `crypto/sha1` packages)
 *
 * Aligned with: gosec G401, Bandit B303/B304, OWASP Benchmark `hash` category.
 *
 * Replaces (and supersedes) the broken taint-sink registration
 * `{method:'getInstance', class:'MessageDigest', type:'weak_hash'}` that
 * could never fire on a literal algorithm name.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface WeakHashResult {
    findings: Array<{
        line: number;
        language: string;
        algorithm: string;
        api: string;
    }>;
}
export declare class WeakHashPass implements AnalysisPass<WeakHashResult> {
    readonly name = "weak-hash";
    readonly category: "security";
    run(ctx: PassContext): WeakHashResult;
    private detect;
}
//# sourceMappingURL=weak-hash-pass.d.ts.map