mirror of
https://github.com/github/codeql.git
synced 2026-03-23 07:56:54 +01:00
18 lines
663 B
Plaintext
18 lines
663 B
Plaintext
/**
|
|
* @name Use of password hash with insufficient computational effort
|
|
* @description Creating a hash of a password with low computational effort makes the hash vulnerable to password cracking attacks.
|
|
* @kind problem
|
|
* @problem.severity warning
|
|
* @precision high
|
|
* @id js/insufficient-password-hash
|
|
* @tags security
|
|
* external/cwe/cwe-916
|
|
*/
|
|
|
|
import javascript
|
|
import semmle.javascript.security.dataflow.InsufficientPasswordHash::InsufficientPasswordHash
|
|
|
|
from Configuration cfg, DataFlow::Node source, DataFlow::Node sink
|
|
where cfg.hasFlow(source, sink)
|
|
select sink, "Password from $@ is hashed insecurely.", source , source.(Source).describe()
|