hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-18 05:24:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
This commit is contained in:
Geoffrey White
2024-01-05 13:04:47 +00:00
committed by GitHub
parent 2ab5e6f64c
commit 657e4d4132
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
swift/ql/src/queries/Security/CWE-328/WeakPasswordHashing.qhelp
View File

@@ -4,8 +4,7 @@
<qhelp>
<overview>
<p>
Using a insufficiently computationally hard hash function can leave data
vulnerable, and should not be used for password hashing.
Hash functions that are not sufficiently computationally hard can leave data vulnerable. You should not use such functions for password hashing.
</p>
<p>
@@ -34,14 +33,14 @@
</p>
<p>
Password hashing algorithms are designed to be slow and/or memory intenstive to compute, which makes brute force attacks more difficult.
Password hashing algorithms should be slow and/or memory intensive to compute, to make brute force attacks more difficult.
</p>
</overview>
<recommendation>
<p>
Ensure that for password storage you should use a computationally hard cryptographic hash function, such as:
For password storage, you should use a computationally hard cryptographic hash function, such as one of the following:
</p>
<ul>
@@ -63,9 +62,9 @@
<example>
<p>
The following examples show a function that hashes a password using a cryptographic hashing algorithm.
The following examples show two versions of the same function. In both cases, a password is hashed using a cryptographic hashing algorithm.
In the first case the SHA-512 hashing algorithm is used. It is vulnerable to offline brute force attacks:
In the first case, the SHA-512 hashing algorithm is used. It is vulnerable to offline brute force attacks:
</p>
<sample src="WeakPasswordHashingBad.swift"/>
<p>