Merge pull request microsoft#1876 from microsoft/suppress-codeql-false-positive

Suppress false positives about Git's usage of SHA-1

Author: dscho

GVFS/GVFS.Common/Git/HashingStream.cs

@@ -17,7 +17,7 @@ public HashingStream(Stream stream)
         {
             this.stream = stream;
 
-            this.hash = SHA1.Create();
+            this.hash = SHA1.Create(); // CodeQL [SM02196] SHA-1 is acceptable here because this is Git's hashing algorithm, not used for cryptographic purposes
             this.hashResult = null;
             this.hash.Initialize();
             this.closed = false;

GVFS/GVFS.Common/SHA1Util.cs

@@ -21,7 +21,7 @@ public static byte[] SHA1ForUTF8String(string s)
         {
             byte[] bytes = Encoding.UTF8.GetBytes(s);
 
-            using (SHA1 sha1 = SHA1.Create())
+            using (SHA1 sha1 = SHA1.Create()) // CodeQL [SM02196] SHA-1 is acceptable here because this is Git's hashing algorithm, not used for cryptographic purposes
             {
                 return sha1.ComputeHash(bytes);
             }

GVFS/GVFS.Virtualization/Projection/GitIndexProjection.FolderData.cs

@@ -54,7 +54,7 @@ public void Include()
 
             public string HashedChildrenNamesSha()
             {
-                using (HashAlgorithm hash = SHA1.Create())
+                using (HashAlgorithm hash = SHA1.Create()) // CodeQL [SM02196] SHA-1 is acceptable here because this is Git's hashing algorithm, not used for cryptographic purposes
                 {
                     for (int i = 0; i < this.ChildEntries.Count; i++)
                     {