Update ruby/ql/src/experimental/cwe-208/UnsafeHmacComparison.ql

boveus · alexrford · web-flow · commit b899b648e5a2 · 2023-08-10T09:21:16.000-04:00
Co-authored-by: Alex Ford &lt;alexrford@users.noreply.github.com&gt;
diff --git a/ruby/ql/src/experimental/cwe-208/UnsafeHmacComparison.ql b/ruby/ql/src/experimental/cwe-208/UnsafeHmacComparison.ql
@@ -38,6 +38,7 @@ private module UnsafeHmacComparison {
   import DataFlow::Global<Config>
 }
 
+private import UnsafeHmacComparison::PathGraph
 from UnsafeHmacComparison::PathNode source, UnsafeHmacComparison::PathNode sink
 where UnsafeHmacComparison::flowPath(source, sink)
 select sink.getNode(), source, sink, "This comparison is potentially vulnerable to a timing attack."

Original file line number	Diff line number	Diff line change
`@@ -38,6 +38,7 @@ private module UnsafeHmacComparison {`
`38`	`38`	`import DataFlow::Global<Config>`
`39`	`39`	`}`
`40`	`40`
	`41`	`+private import UnsafeHmacComparison::PathGraph`
`41`	`42`	`from UnsafeHmacComparison::PathNode source, UnsafeHmacComparison::PathNode sink`
`42`	`43`	`where UnsafeHmacComparison::flowPath(source, sink)`
`43`	`44`	`select sink.getNode(), source, sink, "This comparison is potentially vulnerable to a timing attack."`