File tree Expand file tree Collapse file tree 2 files changed +11
-9
lines changed
lib/semmle/javascript/frameworks
src/Security/CWE-916/examples Expand file tree Collapse file tree 2 files changed +11
-9
lines changed Original file line number Diff line number Diff line change 4
4
5
5
import javascript
6
6
import semmle.javascript.Concepts:: Cryptography
7
+ private import semmle.javascript.security.internal.CryptoAlgorithmNames
7
8
8
9
/**
9
10
* A key used in a cryptographic algorithm.
@@ -353,7 +354,7 @@ private module CryptoJS {
353
354
input = result .getParameter ( 0 )
354
355
}
355
356
356
- private DataFlow :: CallNode getUpdatedApplication ( DataFlow :: Node input , InstantiatedAlgorithm instantiation ) {
357
+ private API :: CallNode getUpdatedApplication ( API :: Node input , InstantiatedAlgorithm instantiation ) {
357
358
/*
358
359
* ```
359
360
* var CryptoJS = require("crypto-js");
@@ -375,12 +376,13 @@ private module CryptoJS {
375
376
*/
376
377
377
378
result = instantiation .getAMemberCall ( "update" ) and
378
- input = result .getArgument ( 0 )
379
+ input = result .getParameter ( 0 )
379
380
}
380
381
381
382
private class Apply extends CryptographicOperation:: Range instanceof API:: CallNode {
382
383
API:: Node input ;
383
384
CryptographicAlgorithm algorithm ; // non-functional
385
+ InstantiatedAlgorithm instantiation ;
384
386
385
387
Apply ( ) {
386
388
this = getEncryptionApplication ( input , algorithm ) or
Original file line number Diff line number Diff line change 1
- const crypto = require ( 'crypto-js' )
2
- function hashPassword ( email , password ) {
3
- var algo = crypto . algo . SHA512 . create ( )
4
- algo . update ( password , 'utf-8' ) // BAD
5
- algo . update ( email . toLowerCase ( ) , 'utf-8' )
6
- var hash = algo . finalize ( )
7
- return hash . toString ( crypto . enc . Base64 )
1
+ const crypto = require ( 'crypto-js' )
2
+ function hashPassword ( email , password ) {
3
+ var algo = crypto . algo . SHA512 . create ( )
4
+ algo . update ( password , 'utf-8' ) // BAD
5
+ algo . update ( email . toLowerCase ( ) , 'utf-8' )
6
+ var hash = algo . finalize ( )
7
+ return hash . toString ( crypto . enc . Base64 )
8
8
}
You can’t perform that action at this time.
0 commit comments