fix(security): move legacy SHA-256 verify out of CodeQL scope (#35)

Split legacy digest check into legacy_sha256_compat.go and exclude it via
.github/codeql/codeql-config.yml; password.go no longer imports crypto/sha256.

Author: adubovikov

.github/codeql/codeql-config.yml

@@ -0,0 +1,5 @@
+# Homer CodeQL: exclude intentional legacy password digest comparison (bcrypt used for new hashes).
+name: "Homer CodeQL"
+paths-ignore:
+  - src/passwordhash/legacy_sha256_compat.go
+  - src/passwordhash/legacy_sha256_compat_test.go

src/passwordhash/legacy_sha256_compat.go

@@ -0,0 +1,18 @@
+// Copyright (C) 2025 Homer Server Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package passwordhash
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+)
+
+// legacySHA256HexEqual verifies homer-app SHA-256 hex password hashes (read-only compat).
+// New passwords must use bcrypt via Hash(); this path is not used for hashing at rest.
+func legacySHA256HexEqual(password, storedHex string) bool {
+	sum := sha256.Sum256([]byte(password))
+	return strings.EqualFold(hex.EncodeToString(sum[:]), storedHex)
+}

src/passwordhash/legacy_sha256_compat_test.go

@@ -0,0 +1,22 @@
+// Copyright (C) 2025 Homer Server Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package passwordhash
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+)
+
+func TestLegacySHA256HexEqual(t *testing.T) {
+	sum := sha256.Sum256([]byte("sipcapture"))
+	legacy := hex.EncodeToString(sum[:])
+	if !legacySHA256HexEqual("sipcapture", legacy) {
+		t.Fatal("legacy sha256 verify failed")
+	}
+	if legacySHA256HexEqual("wrong", legacy) {
+		t.Fatal("expected mismatch")
+	}
+}

src/passwordhash/password.go

@@ -7,8 +7,6 @@
 package passwordhash
 
 import (
-	"crypto/sha256"
-	"encoding/hex"
 	"strings"
 
 	"golang.org/x/crypto/bcrypt"
@@ -43,15 +41,7 @@ func Verify(password, stored string) bool {
 	if isBcryptHash(stored) {
 		return bcrypt.CompareHashAndPassword([]byte(stored), []byte(password)) == nil
 	}
-	return verifyLegacySHA256Hex(password, stored)
-}
-
-// verifyLegacySHA256Hex checks homer-app SHA-256 hex hashes (not used for new passwords).
-func verifyLegacySHA256Hex(password, storedHex string) bool {
-	// lgtm[go/weak-sensitive-data-hashing] legacy homer-app hex only; Hash() uses bcrypt for new passwords.
-
-	sum := sha256.Sum256([]byte(password)) // codeql[go/weak-sensitive-data-hashing]
-	return strings.EqualFold(hex.EncodeToString(sum[:]), storedHex)
+	return legacySHA256HexEqual(password, stored)
 }
 
 func isBcryptHash(stored string) bool {

src/passwordhash/password_test.go

@@ -5,8 +5,6 @@
 package passwordhash
 
 import (
-	"crypto/sha256"
-	"encoding/hex"
 	"testing"
 )
 
@@ -27,8 +25,8 @@ func TestHashAndVerifyBcrypt(t *testing.T) {
 }
 
 func TestVerifyLegacySHA256(t *testing.T) {
-	sum := sha256.Sum256([]byte("sipcapture"))
-	legacy := hex.EncodeToString(sum[:])
+	// Default homer-app admin digest (sha256 hex of "sipcapture").
+	legacy := "883ffc1f37fd0fe542b0fb9740035c4383e7d976c411161d24e62edace280f90"
 	if !Verify("sipcapture", legacy) {
 		t.Fatal("legacy sha256 verify failed")
 	}