hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Enhance the additional step flow and update qldoc

Browse Source
This commit is contained in:
luchua-bc
2021-01-07 13:15:30 +00:00
parent ce2db21f15
commit 19ff00bad4
2 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.qhelp
View File

@@ -2,7 +2,7 @@
<qhelp>
<overview>
<p>In cryptography, "salt" is random data that are used as an additional input to a one-way function that hashes a password or pass-phrase. It makes dictionary attacks more difficult.</p>
<p>In cryptography, a salt is some random data used as an additional input to a one-way function that hashes a password or pass-phrase. It makes dictionary attacks more difficult.</p>
<p>Without a salt, it is much easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables to crack passwords.</p>
</overview>

22
java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.ql
View File

@@ -1,8 +1,8 @@
/**
* @id java/hash-without-salt
* @name Use of a One-Way Hash without a Salt
* @name Use of a hash function without a salt
* @description Hashed passwords without a salt are vulnerable to dictionary attacks.
* @kind path-problem
* @id java/hash-without-salt
* @tags security
* external/cwe-759
*/
@@ -11,7 +11,7 @@ import java
import semmle.code.java.dataflow.TaintTracking
import DataFlow::PathGraph
/** The Java class `java.security.MessageDigest` */
/** The Java class `java.security.MessageDigest`. */
class MessageDigest extends RefType {
MessageDigest() { this.hasQualifiedName("java.security", "MessageDigest") }
}
@@ -19,22 +19,20 @@ class MessageDigest extends RefType {
/** The method `digest()` declared in `java.security.MessageDigest`. */
class MDDigestMethod extends Method {
MDDigestMethod() {
getDeclaringType() instanceof MessageDigest and
hasName("digest")
this.getDeclaringType() instanceof MessageDigest and
this.hasName("digest")
}
}
/** The method `update()` declared in `java.security.MessageDigest`. */
class MDUpdateMethod extends Method {
MDUpdateMethod() {
getDeclaringType() instanceof MessageDigest and
hasName("update")
this.getDeclaringType() instanceof MessageDigest and
this.hasName("update")
}
}
/**
* Gets a regular expression for matching common names of variables that indicate the value being held is a password.
*/
/** Gets a regular expression for matching common names of variables that indicate the value being held is a password. */
string getPasswordRegex() { result = "(?i).*pass(wd|word|code|phrase).*" }
/** Finds variables that hold password information judging by their names. */
@@ -78,9 +76,11 @@ class HashWithoutSaltConfiguration extends TaintTracking::Configuration {
)
}
/** Holds for additional steps such as `passwordStr.getBytes()` */
/** Holds for additional steps that flow to a method call of `update` or `digest` declared in `java.security.MessageDigest`. */
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(MethodAccess ma |
ma.getMethod().getDeclaringType() instanceof MessageDigest and
ma.getMethod().hasName(["digest", "update"]) and
pred.asExpr() = ma.getAnArgument() and
(succ.asExpr() = ma or succ.asExpr() = ma.getQualifier())
)