Fixed Conflicts due to recent changes to file

smiddy007 · smiddy007 · commit cef6b95b15d7 · 2023-03-26T22:32:34.000-04:00
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/CryptoLibraries.qll b/javascript/ql/lib/semmle/javascript/frameworks/CryptoLibraries.qll
@@ -4,6 +4,7 @@
 
 import javascript
 import semmle.javascript.Concepts::Cryptography
+private import semmle.javascript.security.internal.CryptoAlgorithmNames
 
 /**
  * A key used in a cryptographic algorithm.
@@ -353,7 +354,7 @@ private module CryptoJS {
     input = result.getParameter(0)
   }
 
-  private DataFlow::CallNode getUpdatedApplication (DataFlow::Node input, InstantiatedAlgorithm instantiation) {
+  private API::CallNode getUpdatedApplication (API::Node input, InstantiatedAlgorithm instantiation) {
     /*
      *    ```
      *    var CryptoJS = require("crypto-js");
@@ -375,12 +376,13 @@ private module CryptoJS {
      */
 
     result = instantiation.getAMemberCall("update") and
-    input = result.getArgument(0)
+    input = result.getParameter(0)
   } 
 
   private class Apply extends CryptographicOperation::Range instanceof API::CallNode {
     API::Node input;
     CryptographicAlgorithm algorithm; // non-functional
+    InstantiatedAlgorithm instantiation;
 
     Apply() {
       this = getEncryptionApplication(input, algorithm) or
diff --git a/javascript/ql/src/Security/CWE-916/examples/InsufficientPasswordHash_CryptoJS.js b/javascript/ql/src/Security/CWE-916/examples/InsufficientPasswordHash_CryptoJS.js
@@ -1,8 +1,8 @@
-const crypto = require('crypto-js')
-function hashPassword(email, password) {
-  var algo = crypto.algo.SHA512.create()
-  algo.update(password, 'utf-8') // BAD
-  algo.update(email.toLowerCase(), 'utf-8')
-  var hash = algo.finalize()
-  return hash.toString(crypto.enc.Base64)
+const crypto = require('crypto-js')
+function hashPassword(email, password) {
+  var algo = crypto.algo.SHA512.create()
+  algo.update(password, 'utf-8') // BAD
+  algo.update(email.toLowerCase(), 'utf-8')
+  var hash = algo.finalize()
+  return hash.toString(crypto.enc.Base64)
 }
