hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 16:25:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

run format document

Browse Source
This commit is contained in:
Brandon Stewart
2023-08-09 18:51:55 +00:00
parent 26401fec70
commit 07d5beca34
1 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
ruby/ql/src/experimental/cwe-208/UnsafeHmacComparison.ql
View File

@@ -2,7 +2,6 @@
* @name Unsafe HMAC Comparison
* @description An HMAC is being compared using the equality operator. This may be vulnerable to a cryptographic timing attack
* because the equality operation does not occur in constant time."
* @kind path-problem
* @problem.severity error
* @security-severity 6.0
@@ -12,7 +11,7 @@
* external/cwe/cwe-208
*/
private import codeql.ruby.AST
private import codeql.ruby.DataFlow
import codeql.ruby.ApiGraphs
import ruby
@@ -29,14 +28,12 @@ private class OpenSslHmacSource extends DataFlow::Node {
private module UnsafeHmacComparison {
private module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof OpenSslHmacSource
}
predicate isSource(DataFlow::Node source) { source instanceof OpenSslHmacSource }
// Holds if a given sink is an Equality Operation (== or !=)
predicate isSink(DataFlow::Node sink) {
any(EqualityOperation eqOp).getAnOperand() = sink.asExpr().getExpr()
}
// Holds if a given sink is an Equality Operation (== or !=)
predicate isSink(DataFlow::Node sink) {
any(EqualityOperation eqOp).getAnOperand() = sink.asExpr().getExpr()
}
}
import DataFlow::Global<Config>
@@ -44,4 +41,4 @@ private module UnsafeHmacComparison {
from UnsafeHmacComparison::PathNode source, UnsafeHmacComparison::PathNode sink
where UnsafeHmacComparison::flowPath(source, sink)
select sink.getNode(), source, sink, "This comparison is potentially vulnerable to a timing attack."
select sink.getNode(), source, sink, "This comparison is potentially vulnerable to a timing attack."