Python: WeakSensitiveDatHashing

d10c · d10c · commit 0ac226c1f94d · 2025-07-07T17:52:01.000+02:00
diff --git a/python/ql/lib/semmle/python/security/dataflow/WeakSensitiveDataHashingQuery.qll b/python/ql/lib/semmle/python/security/dataflow/WeakSensitiveDataHashingQuery.qll
@@ -33,6 +33,8 @@ module NormalHashFunction {
     predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
       sensitiveDataExtraStepForCalls(node1, node2)
     }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
   }
 
   /** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on sensitive data" vulnerabilities. */
@@ -63,6 +65,8 @@ module ComputationallyExpensiveHashFunction {
     predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
       sensitiveDataExtraStepForCalls(node1, node2)
     }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
   }
 
   /** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on passwords" vulnerabilities. */

Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,8 @@ module NormalHashFunction {`
`33`	`33`	`predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {`
`34`	`34`	`sensitiveDataExtraStepForCalls(node1, node2)`
`35`	`35`	`}`
	`36`	`+`
	`37`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
`36`	`38`	`}`
`37`	`39`
`38`	`40`	`/** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on sensitive data" vulnerabilities. */`
`@@ -63,6 +65,8 @@ module ComputationallyExpensiveHashFunction {`
`63`	`65`	`predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {`
`64`	`66`	`sensitiveDataExtraStepForCalls(node1, node2)`
`65`	`67`	`}`
	`68`	`+`
	`69`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
`66`	`70`	`}`
`67`	`71`
`68`	`72`	`/** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on passwords" vulnerabilities. */`