{"id":"1e4ca22677e26f8a","repo":"gohugoio/hugo","slug":"crypto-hash-q-is-not-a-supported-hash-algorithm","errorCode":null,"errorMessage":"crypto.Hash: %q is not a supported hash algorithm","messagePattern":"crypto\\.Hash: %q is not a supported hash algorithm","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tpl/crypto/crypto.go","lineNumber":123,"sourceCode":"\t}\n\n\treturn hex.EncodeToString(h.Sum(nil)), nil\n}\n\nfunc newHash(algo string) (hash.Hash, error) {\n\tswitch algo {\n\tcase \"md5\":\n\t\treturn md5.New(), nil\n\tcase \"sha1\":\n\t\treturn sha1.New(), nil\n\tcase \"sha256\":\n\t\treturn sha256.New(), nil\n\tcase \"sha384\":\n\t\treturn sha512.New384(), nil\n\tcase \"sha512\":\n\t\treturn sha512.New(), nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"crypto.Hash: %q is not a supported hash algorithm\", algo)\n\t}\n}\n\n// HMAC returns a cryptographic hash that uses a key to sign a message.\nfunc (ns *Namespace) HMAC(h any, k any, m any, e ...any) (string, error) {\n\tha, err := cast.ToStringE(h)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tvar hash func() hash.Hash\n\tswitch ha {\n\tcase \"md5\":\n\t\thash = md5.New\n\tcase \"sha1\":\n\t\thash = sha1.New\n\tcase \"sha256\":\n\t\thash = sha256.New","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/gohugoio/hugo/blob/8a468df065a75c1c7cf9f6850f32148746590ea5/tpl/crypto/crypto.go#L105-L141","documentation":"When `crypto.Hash` is given an algorithm name, `newHash` maps it to a Go hash constructor. Only `md5`, `sha1`, `sha256`, `sha384`, and `sha512` are supported; any other string (including casing or naming variants like `SHA-256`) falls through to this error.","triggerScenarios":"`{{ crypto.Hash \"sha3\" $v }}`, `{{ crypto.Hash \"SHA256\" $v }}`, `{{ crypto.Hash \"sha-256\" $v }}`, `{{ crypto.Hash \"blake2b\" $v }}` — anything not exactly one of the five lowercase names; also accidentally passing the value as the first of two args so the content string is treated as the algorithm.","commonSituations":"Using uppercase or hyphenated algorithm names copied from SRI attributes (`sha384-...`) or other tools; expecting algorithms Hugo doesn't ship (sha3, blake2, crc32); swapping argument order so the data lands in the algorithm slot.","solutions":["Use one of the exact lowercase names: md5, sha1, sha256, sha384, or sha512.","Normalize the name, e.g. `{{ crypto.Hash (lower (replace $algo \"-\" \"\")) $v }}` if it comes from data.","Verify argument order: algorithm first, value second — `crypto.Hash \"sha256\" $v`."],"exampleFix":"<!-- before -->\n{{ crypto.Hash \"SHA-256\" $content }}\n<!-- after -->\n{{ crypto.Hash \"sha256\" $content }}","handlingStrategy":"validation","validationCode":"{{ $algo := \"sha256\" }}\n{{ if in (slice \"md5\" \"sha1\" \"sha256\" \"sha512\") $algo }}{{ crypto.Hash $algo .Content }}{{ else }}{{ errorf \"unsupported hash %q\" $algo }}{{ end }}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whitelist algorithm names (md5, sha1, sha256, sha512) before calling","Lowercase the algorithm string — matching is exact","Don't build algorithm names from user/front-matter input without validation"],"tags":["hugo","templates","crypto","hash-algorithm"],"analyzedSha":"8a468df065a75c1c7cf9f6850f32148746590ea5","analyzedAt":"2026-07-31T21:23:07.045Z","schemaVersion":2}