Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e1fae3d

Browse files
asgerfasgerf
committed
JS: Port InsufficientPasswordHash
1 parent fd98b25 commit e1fae3d

3 files changed

Lines changed: 25 additions & 17 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/InsufficientPasswordHashQuery.qll‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,23 @@ import InsufficientPasswordHashCustomizations::InsufficientPasswordHash
1919
* added either by extending the relevant class, or by subclassing this configuration itself,
2020
* and amending the sources and sinks.
2121
*/
22-
class Configuration extends TaintTracking::Configuration {
22+
module InsufficientPasswordHashConfig implements DataFlow::ConfigSig {
23+
predicate isSource(DataFlow::Node source) { source instanceof Source }
24+
25+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
26+
27+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
28+
}
29+
30+
/**
31+
* Taint tracking for password hashing with insufficient computational effort.
32+
*/
33+
module InsufficientPasswordHashFlow = TaintTracking::Global<InsufficientPasswordHashConfig>;
34+
35+
/**
36+
* DEPRECATED. Use the `InsufficientPasswordHashFlow` module instead.
37+
*/
38+
deprecated class Configuration extends TaintTracking::Configuration {
2339
Configuration() { this = "InsufficientPasswordHash" }
2440

2541
override predicate isSource(DataFlow::Node source) { source instanceof Source }

‎javascript/ql/src/Security/CWE-916/InsufficientPasswordHash.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@
1212

1313
import javascript
1414
import semmle.javascript.security.dataflow.InsufficientPasswordHashQuery
15-
import DataFlow::PathGraph
15+
import InsufficientPasswordHashFlow::PathGraph
1616

17-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
18-
where cfg.hasFlowPath(source, sink)
17+
from InsufficientPasswordHashFlow::PathNode source, InsufficientPasswordHashFlow::PathNode sink
18+
where InsufficientPasswordHashFlow::flowPath(source, sink)
1919
select sink.getNode(), source, sink, "Password from $@ is hashed insecurely.", source.getNode(),
2020
source.getNode().(Source).describe()

‎javascript/ql/test/query-tests/Security/CWE-916/InsufficientPasswordHash.expected‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,9 @@
1-
nodes
2-
| tst.js:5:48:5:55 | password |
3-
| tst.js:5:48:5:55 | password |
4-
| tst.js:5:48:5:55 | password |
5-
| tst.js:7:46:7:53 | password |
6-
| tst.js:7:46:7:53 | password |
7-
| tst.js:7:46:7:53 | password |
8-
| tst.js:9:43:9:50 | password |
9-
| tst.js:9:43:9:50 | password |
10-
| tst.js:9:43:9:50 | password |
111
edges
12-
| tst.js:5:48:5:55 | password | tst.js:5:48:5:55 | password |
13-
| tst.js:7:46:7:53 | password | tst.js:7:46:7:53 | password |
14-
| tst.js:9:43:9:50 | password | tst.js:9:43:9:50 | password |
2+
nodes
3+
| tst.js:5:48:5:55 | password | semmle.label | password |
4+
| tst.js:7:46:7:53 | password | semmle.label | password |
5+
| tst.js:9:43:9:50 | password | semmle.label | password |
6+
subpaths
157
#select
168
| tst.js:5:48:5:55 | password | tst.js:5:48:5:55 | password | tst.js:5:48:5:55 | password | Password from $@ is hashed insecurely. | tst.js:5:48:5:55 | password | an access to password |
179
| tst.js:7:46:7:53 | password | tst.js:7:46:7:53 | password | tst.js:7:46:7:53 | password | Password from $@ is hashed insecurely. | tst.js:7:46:7:53 | password | an access to password |

0 commit comments

Comments
 (0)