JS: split BrokenCryptoAlgorithm.qll

javascript/ql/src/semmle/javascript/security/dataflow/BrokenCryptoAlgorithm.qll

@@ -1,29 +1,16 @@
 /**
- * Provides a taint tracking configuration for reasoning about sensitive information in broken or weak cryptographic algorithms.
+ * Provides a taint tracking configuration for reasoning about
+ * sensitive information in broken or weak cryptographic algorithms.
+ *
+ * Note, for performance reasons: only import this file if
+ * `BrokenCryptoAlgorithm::Configuration` is needed, otherwise
+ * `BrokenCryptoAlgorithmCustomizations` should be imported instead.
  */
 
 import javascript
-private import semmle.javascript.security.SensitiveActions
-private import semmle.javascript.frameworks.CryptoLibraries
 
 module BrokenCryptoAlgorithm {
-  /**
-   * A data flow source for sensitive information in broken or weak cryptographic algorithms.
-   */
-  abstract class Source extends DataFlow::Node {
-    /** Gets a string that describes the type of this data flow source. */
-    abstract string describe();
-  }
-
-  /**
-   * A data flow sink for sensitive information in broken or weak cryptographic algorithms.
-   */
-  abstract class Sink extends DataFlow::Node { }
-
-  /**
-   * A sanitizer for sensitive information in broken or weak cryptographic algorithms.
-   */
-  abstract class Sanitizer extends DataFlow::Node { }
+  import BrokenCryptoAlgorithmCustomizations::BrokenCryptoAlgorithm
 
   /**
    * A taint tracking configuration for sensitive information in broken or weak cryptographic algorithms.
@@ -46,26 +33,4 @@ module BrokenCryptoAlgorithm {
       node instanceof Sanitizer
     }
   }
-
-  /**
-   * A sensitive expression, viewed as a data flow source for sensitive information
-   * in broken or weak cryptographic algorithms.
-   */
-  class SensitiveExprSource extends Source, DataFlow::ValueNode {
-    override SensitiveExpr astNode;
-
-    override string describe() { result = astNode.describe() }
-  }
-
-  /**
-   * An expression used by a broken or weak cryptographic algorithm.
-   */
-  class WeakCryptographicOperationSink extends Sink {
-    WeakCryptographicOperationSink() {
-      exists(CryptographicOperation application |
-        application.getAlgorithm().isWeak() and
-        this.asExpr() = application.getInput()
-      )
-    }
-  }
 }

javascript/ql/src/semmle/javascript/security/dataflow/BrokenCryptoAlgorithmCustomizations.qll

@@ -0,0 +1,51 @@
+/**
+ * Provides default sources, sinks and sanitisers for reasoning about
+ * sensitive information in broken or weak cryptographic algorithms,
+ * as well as extension points for adding your own.
+ */
+
+import javascript
+private import semmle.javascript.security.SensitiveActions
+private import semmle.javascript.frameworks.CryptoLibraries
+
+module BrokenCryptoAlgorithm {
+  /**
+   * A data flow source for sensitive information in broken or weak cryptographic algorithms.
+   */
+  abstract class Source extends DataFlow::Node {
+    /** Gets a string that describes the type of this data flow source. */
+    abstract string describe();
+  }
+
+  /**
+   * A data flow sink for sensitive information in broken or weak cryptographic algorithms.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for sensitive information in broken or weak cryptographic algorithms.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sensitive expression, viewed as a data flow source for sensitive information
+   * in broken or weak cryptographic algorithms.
+   */
+  class SensitiveExprSource extends Source, DataFlow::ValueNode {
+    override SensitiveExpr astNode;
+
+    override string describe() { result = astNode.describe() }
+  }
+
+  /**
+   * An expression used by a broken or weak cryptographic algorithm.
+   */
+  class WeakCryptographicOperationSink extends Sink {
+    WeakCryptographicOperationSink() {
+      exists(CryptographicOperation application |
+        application.getAlgorithm().isWeak() and
+        this.asExpr() = application.getInput()
+      )
+    }
+  }
+}