Ruby: WeakSensitiveDataHashing

d10c · d10c · commit f5727bc2ffe1 · 2025-07-04T16:19:35.000+02:00
diff --git a/ruby/ql/lib/codeql/ruby/security/WeakSensitiveDataHashingQuery.qll b/ruby/ql/lib/codeql/ruby/security/WeakSensitiveDataHashingQuery.qll
@@ -28,6 +28,8 @@ module NormalHashFunction {
     predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
   }
 
   /** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on sensitive data" vulnerabilities. */
@@ -54,6 +56,8 @@ module ComputationallyExpensiveHashFunction {
     predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
   }
 
   /** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on passwords" vulnerabilities. */

Original file line number	Diff line number	Diff line change
`@@ -28,6 +28,8 @@ module NormalHashFunction {`
`28`	`28`	`predicate isSink(DataFlow::Node sink) { sink instanceof Sink }`
`29`	`29`
`30`	`30`	`predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }`
	`31`	`+`
	`32`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
`31`	`33`	`}`
`32`	`34`
`33`	`35`	`/** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on sensitive data" vulnerabilities. */`
`@@ -54,6 +56,8 @@ module ComputationallyExpensiveHashFunction {`
`54`	`56`	`predicate isSink(DataFlow::Node sink) { sink instanceof Sink }`
`55`	`57`
`56`	`58`	`predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }`
	`59`	`+`
	`60`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
`57`	`61`	`}`
`58`	`62`
`59`	`63`	`/** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on passwords" vulnerabilities. */`