Add more source of crypto call

2026-04-30 19:26:02 +02:00 · 2022-08-31 17:13:43 +01:00
parent cf83b07aae
commit 0fd684cde8
1 changed files with 7 additions and 0 deletions
--- a/python/ql/src/experimental/semmle/python/security/TimingAttack.qll
+++ b/python/ql/src/experimental/semmle/python/security/TimingAttack.qll
@@ -122,6 +122,13 @@ private class ProduceCiphertextCall extends ProduceCryptoCall {
          .getMember(["DES", "DES3", "ARC2", "ARC4", "Blowfish", "PKCS1_v1_5"])
          .getMember(["ARC4Cipher", "new", "PKCS115_Cipher"])
          .getMember("encrypt")
+          .getACall() or
+    this =
+      cryptographylib()
+          .getMember("ciphers")
+          .getMember("Cipher")
+          .getReturn()
+          .getMember("finalize")
          .getACall()
  }