hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 21:25:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7252 from museljh/feature/cwe-338

Browse Source 
Python: CWE-338 insecureRandomness
This commit is contained in:
Rasmus Wriedt Larsen
2022-02-07 19:30:06 +01:00
committed by GitHub
parent 9217d0e1b9 1dd15fa235
commit eb109828c0
9 changed files with 212 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/test/experimental/query-tests/Security/CWE-338/InsecureRandomness.expected Normal file
View File

@@ -0,0 +1,6 @@
edges
nodes
| InsecureRandomness.py:5:12:5:26 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
subpaths
#select
| InsecureRandomness.py:5:12:5:26 | ControlFlowNode for Attribute() | InsecureRandomness.py:5:12:5:26 | ControlFlowNode for Attribute() | InsecureRandomness.py:5:12:5:26 | ControlFlowNode for Attribute() | Cryptographically insecure $@ in a security context. | InsecureRandomness.py:5:12:5:26 | ControlFlowNode for Attribute() | random value |

5
python/ql/test/experimental/query-tests/Security/CWE-338/InsecureRandomness.py Normal file
View File

@@ -0,0 +1,5 @@
import random
def generatePassword():
# BAD: the random is not cryptographically secure
return random.random()

1
python/ql/test/experimental/query-tests/Security/CWE-338/InsecureRandomness.qlref Normal file
View File

@@ -0,0 +1 @@
experimental/Security/CWE-338/InsecureRandomness.ql