Merge pull request #66 from NoahStolk/dependabot/nuget/src/MSTest.Tes… · NoahStolk/ddinfo-core@e208f0f

Node.js 16 actions are deprecated. Please update the following actions to use Node.js 20: actions/setup-dotnet@v1, actions/checkout@v2. For more information see: https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/.

The following actions uses node12 which is deprecated and will be forced to run on node16: actions/setup-dotnet@v1, actions/checkout@v2. For more info: https://github.blog/changelog/2023-06-13-github-actions-all-actions-will-run-on-node16-instead-of-node12-by-default/

src/DevilDaggersInfo.Core.Encryption/AesBase32Wrapper.cs#L61

Rfc2898DeriveBytes might be using a weak hash algorithm. Use SHA256, SHA384, or SHA512 to create a strong key from a password. (https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5379)

src/DevilDaggersInfo.Core.Encryption/AesBase32Wrapper.cs#L66

Symmetric encryption uses non-default initialization vector, which could be potentially repeatable (https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5401)

src/DevilDaggersInfo.Core.Encryption/AesBase32Wrapper.cs#L62

Use at least 100000 iterations when deriving a cryptographic key from a password. By default, Rfc2898DeriveByte's IterationCount is only 1000 (https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5387)

src/DevilDaggersInfo.Core.Common/Extensions/TimeExtensions.cs#L3