codeql

mirror of https://github.com/github/codeql.git synced 2025-12-21 03:06:31 +01:00

Files

Rasmus Wriedt Larsen dee93783a2 Python: Update .expected for py/weak-sensitive-data-hashing

Now there is a path from the _imports_ of the functions that would
return sensitive data, so we produce more alerts.

I'm not entirely happy about this "double reporting", but I'm not sure
how to get around it without either:

1. disabling the extra taint-step for calls. Not ideal since we would
   loose good sources.
2. disabling the extra sources based on function name. Not ideal since
   we would loose good sources.
3. disabling the extra sources based on function name, for those calls
   that would be handled with the extra taint-step for calls. Not ideal
   since that would require running the data-flow query initially to
   prune these out :|

So for now, I think the best approach is to accept some risk on this,
and ship to learn :)

2021-06-11 13:56:55 +02:00

README.md

Python: Add py/weak-sensitive-data-hashing query

2021-04-22 15:23:41 +02:00

test_cryptodome.py

Python: Add py/weak-sensitive-data-hashing query

2021-04-22 15:23:41 +02:00

test_cryptography.py

Python: Add py/weak-sensitive-data-hashing query

2021-04-22 15:23:41 +02:00

WeakSensitiveDataHashing.expected

Python: Update .expected for py/weak-sensitive-data-hashing