Skip to content

Commit 753dca9

Browse files
committed
Python: weak-crypto: Make algorithm selection less brittle
As discussed in github#5635 (comment)
1 parent 22d4d79 commit 753dca9

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,9 @@ from Cryptography::CryptographicOperation operation, Cryptography::Cryptographic
1616
where
1717
algorithm = operation.getAlgorithm() and
1818
algorithm.isWeak() and
19-
not algorithm instanceof Cryptography::HashingAlgorithm and // handled by `py/weak-sensitive-data-hashing`
20-
not algorithm instanceof Cryptography::PasswordHashingAlgorithm // handled by `py/weak-sensitive-data-hashing`
19+
// `Cryptography::HashingAlgorithm` and `Cryptography::PasswordHashingAlgorithm` are
20+
// handled by `py/weak-sensitive-data-hashing`
21+
algorithm instanceof Cryptography::EncryptionAlgorithm
2122
select operation,
2223
"The cryptographic algorithm " + algorithm.getName() +
2324
" is broken or weak, and should not be used."

0 commit comments

Comments
 (0)