fix(python): detect standalone PyCA hash constructions

[sachin9058]

Summary

Standalone PyCA hash constructions such as:

hashes.Hash(hashes.SHA256())

were not detected because the corresponding detection rules were not registered in the Python rule registry.

Root Cause

PycaHash detection rules existed but were not included in the top-level Python detection configuration. As a result, hash constructions were never evaluated during analysis.

Changes

• Register PycaHash detection rules in the Python detection rule set
• Add regression test covering standalone hash detection

Example

Before:

hashes.Hash(hashes.SHA256())

No finding produced.

After:

hashes.Hash(hashes.SHA256())

SHA256 is detected and included in analysis results.

Testing

Added regression test verifying SHA256 hash constructions are detected.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds detection and translation support for direct hash computations using cryptography.hazmat.primitives.hashes.Hash(...), along with new test fixtures to validate the rule behavior.

Changes:

• Introduces a new detection rule for hashes.Hash(hashes.<ALG>()) patterns and wires it into the Python rules registry.
• Extends digest-context translation to accept Algorithm values in addition to ValueAction.
• Adds a new Java test + Python fixture for the direct-hash wrapper case, and adjusts an elliptic-curve signing fixture.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
python/src/main/java/com/ibm/plugin/rules/detection/hash/PycaHash.java	Adds a new detection rule for direct hash wrapper usage and exposes it via wrapperRules()
python/src/main/java/com/ibm/plugin/rules/detection/PythonDetectionRules.java	Registers the new hash wrapper rules into the global Python detection rules list
python/src/main/java/com/ibm/plugin/translation/translator/contexts/PycaDigestContextTranslator.java	Updates digest translation gating logic to include Algorithm-valued detections
python/src/test/java/com/ibm/plugin/rules/detection/hash/PycaHashDirectTest.java	Adds a test asserting detection + translation of hashes.Hash(hashes.SHA256())
python/src/test/files/rules/detection/hash/PycaHashDirectTest.py	Adds the Python source fixture for the new rule
python/src/test/files/rules/detection/asymmetric/EllipticCurve/PycaEllipticCurveSignTestFile.py	Simplifies the digest used in the ECDSA Prehashed fixture

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.