1
1
/**
2
- * @name Timing attacks due to comparision of sensitive secrets
3
- * @description using a non-constant time comparision method to comapre secrets can lead to authoriztion vulnerabilities
2
+ * @name Timing attacks due to comparison of sensitive secrets
3
+ * @description using a non-constant time comparison method to comapre secrets can lead to authoriztion vulnerabilities
4
4
* @kind path-problem
5
5
* @problem.severity warning
6
6
* @id go/timing-attack
@@ -19,27 +19,17 @@ private predicate isBadResult(DataFlow::Node e) {
19
19
)
20
20
}
21
21
22
- /**
23
- * A data flow source for timing attack vulnerabilities.
24
- */
25
- abstract class Source extends DataFlow:: Node { }
26
-
27
22
/**
28
23
* A data flow sink for timing attack vulnerabilities.
29
24
*/
30
25
abstract class Sink extends DataFlow:: Node { }
31
26
32
- /**
33
- * A sanitizer for timing attack vulnerabilities.
34
- */
35
- abstract class Sanitizer extends DataFlow:: Node { }
36
-
37
- /** A taint-tracking sink which models comparisions of sensitive variables. */
27
+ /** A taint-tracking sink which models comparisons of sensitive variables. */
38
28
private class SensitiveCompareSink extends Sink {
39
29
ComparisonExpr c ;
40
30
41
31
SensitiveCompareSink ( ) {
42
- // We select a comparision where a secret or password is tested.
32
+ // We select a comparison where a secret or password is tested.
43
33
exists ( SensitiveVariableAccess op1 , Expr op2 |
44
34
op1 .getClassification ( ) = [ SensitiveExpr:: secret ( ) , SensitiveExpr:: password ( ) ] and
45
35
// exclude grant to avoid FP from OAuth
@@ -48,10 +38,10 @@ private class SensitiveCompareSink extends Sink {
48
38
op2 = c .getAnOperand ( ) and
49
39
not op1 = op2 and
50
40
not (
51
- // Comparisions with `nil` should be excluded.
41
+ // Comparisons with `nil` should be excluded.
52
42
op2 = Builtin:: nil ( ) .getAReference ( )
53
43
or
54
- // Comparisions with empty string should also be excluded.
44
+ // Comparisons with empty string should also be excluded.
55
45
op2 .getStringValue ( ) .length ( ) = 0
56
46
)
57
47
|
0 commit comments