diff --git a/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.qhelp b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.qhelp index 7e9fe996eeb..0bc3f7493a6 100755 --- a/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.qhelp +++ b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.qhelp @@ -62,12 +62,14 @@ The following examples show a function for fetching data from a URL along with a hash of the data, perhaps to check the data has not been tampered with. +
+In the first case the MD5 hashing algorithm is used that is known to be vulnerable to collision attacks.
+
Here is the same function using SHA-512, which is a strong cryptographic hashing function.