hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixed Conflicts due to recent changes to file

Browse Source
This commit is contained in:
smiddy007
2023-03-26 22:32:34 -04:00
parent ad527b8f69
commit cef6b95b15
2 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/lib/semmle/javascript/frameworks/CryptoLibraries.qll
View File

@@ -4,6 +4,7 @@
import javascript
import semmle.javascript.Concepts::Cryptography
private import semmle.javascript.security.internal.CryptoAlgorithmNames
/**
* A key used in a cryptographic algorithm.
@@ -353,7 +354,7 @@ private module CryptoJS {
input = result.getParameter(0)
}
private DataFlow::CallNode getUpdatedApplication (DataFlow::Node input, InstantiatedAlgorithm instantiation) {
private API::CallNode getUpdatedApplication (API::Node input, InstantiatedAlgorithm instantiation) {
/*
* ```
* var CryptoJS = require("crypto-js");
@@ -375,12 +376,13 @@ private module CryptoJS {
*/
result = instantiation.getAMemberCall("update") and
input = result.getArgument(0)
input = result.getParameter(0)
}
private class Apply extends CryptographicOperation::Range instanceof API::CallNode {
API::Node input;
CryptographicAlgorithm algorithm; // non-functional
InstantiatedAlgorithm instantiation;
Apply() {
this = getEncryptionApplication(input, algorithm) or

14
javascript/ql/src/Security/CWE-916/examples/InsufficientPasswordHash_CryptoJS.js
View File

@@ -1,8 +1,8 @@
const crypto = require('crypto-js')
function hashPassword(email, password) {
var algo = crypto.algo.SHA512.create()
algo.update(password, 'utf-8') // BAD
algo.update(email.toLowerCase(), 'utf-8')
var hash = algo.finalize()
return hash.toString(crypto.enc.Base64)
const crypto = require('crypto-js')
function hashPassword(email, password) {
var algo = crypto.algo.SHA512.create()
algo.update(password, 'utf-8') // BAD
algo.update(email.toLowerCase(), 'utf-8')
var hash = algo.finalize()
return hash.toString(crypto.enc.Base64)
}