Skip to content

Commit a70d742

Browse files
owen-mcowen-mc
committed
Add test for good password hashing
1 parent f562b3d commit a70d742

File tree

2 files changed

+31
-19
lines changed

2 files changed

+31
-19
lines changed

‎go/ql/test/query-tests/Security/CWE-327/WeakSensitiveDataHashing.expected‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,24 @@
11
#select
2-
| hashing.go:20:8:20:22 | secretByteSlice | hashing.go:20:8:20:22 | secretByteSlice | hashing.go:20:8:20:22 | secretByteSlice | $@ is used in a hashing algorithm (MD5) that is insecure. | hashing.go:20:8:20:22 | secretByteSlice | Sensitive data (secret) |
3-
| hashing.go:21:10:21:24 | secretByteSlice | hashing.go:21:10:21:24 | secretByteSlice | hashing.go:21:10:21:24 | secretByteSlice | $@ is used in a hashing algorithm (MD5) that is insecure. | hashing.go:21:10:21:24 | secretByteSlice | Sensitive data (secret) |
4-
| hashing.go:22:20:22:31 | secretString | hashing.go:22:20:22:31 | secretString | hashing.go:22:20:22:31 | secretString | $@ is used in a hashing algorithm (MD5) that is insecure. | hashing.go:22:20:22:31 | secretString | Sensitive data (secret) |
2+
| hashing.go:22:8:22:22 | secretByteSlice | hashing.go:22:8:22:22 | secretByteSlice | hashing.go:22:8:22:22 | secretByteSlice | $@ is used in a hashing algorithm (MD5) that is insecure. | hashing.go:22:8:22:22 | secretByteSlice | Sensitive data (secret) |
53
| hashing.go:23:10:23:24 | secretByteSlice | hashing.go:23:10:23:24 | secretByteSlice | hashing.go:23:10:23:24 | secretByteSlice | $@ is used in a hashing algorithm (MD5) that is insecure. | hashing.go:23:10:23:24 | secretByteSlice | Sensitive data (secret) |
6-
| hashing.go:25:17:25:31 | secretByteSlice | hashing.go:25:17:25:31 | secretByteSlice | hashing.go:25:17:25:31 | secretByteSlice | $@ is used in a hashing algorithm (SHA1) that is insecure. | hashing.go:25:17:25:31 | secretByteSlice | Sensitive data (secret) |
7-
| hashing.go:26:11:26:25 | secretByteSlice | hashing.go:26:11:26:25 | secretByteSlice | hashing.go:26:11:26:25 | secretByteSlice | $@ is used in a hashing algorithm (SHA1) that is insecure. | hashing.go:26:11:26:25 | secretByteSlice | Sensitive data (secret) |
8-
| hashing.go:28:16:28:30 | secretByteSlice | hashing.go:28:16:28:30 | secretByteSlice | hashing.go:28:16:28:30 | secretByteSlice | $@ is used in a hashing algorithm (MD4) that is insecure. | hashing.go:28:16:28:30 | secretByteSlice | Sensitive data (secret) |
9-
| hashing.go:29:22:29:36 | secretByteSlice | hashing.go:29:22:29:36 | secretByteSlice | hashing.go:29:22:29:36 | secretByteSlice | $@ is used in a hashing algorithm (RIPEMD160) that is insecure. | hashing.go:29:22:29:36 | secretByteSlice | Sensitive data (secret) |
10-
| hashing.go:80:16:80:23 | password | hashing.go:80:16:80:23 | password | hashing.go:80:16:80:23 | password | $@ is used in a hashing algorithm (SHA256) that is insecure for password hashing, since it is not a computationally expensive hash function. | hashing.go:80:16:80:23 | password | Sensitive data (password) |
4+
| hashing.go:24:20:24:31 | secretString | hashing.go:24:20:24:31 | secretString | hashing.go:24:20:24:31 | secretString | $@ is used in a hashing algorithm (MD5) that is insecure. | hashing.go:24:20:24:31 | secretString | Sensitive data (secret) |
5+
| hashing.go:25:10:25:24 | secretByteSlice | hashing.go:25:10:25:24 | secretByteSlice | hashing.go:25:10:25:24 | secretByteSlice | $@ is used in a hashing algorithm (MD5) that is insecure. | hashing.go:25:10:25:24 | secretByteSlice | Sensitive data (secret) |
6+
| hashing.go:27:17:27:31 | secretByteSlice | hashing.go:27:17:27:31 | secretByteSlice | hashing.go:27:17:27:31 | secretByteSlice | $@ is used in a hashing algorithm (SHA1) that is insecure. | hashing.go:27:17:27:31 | secretByteSlice | Sensitive data (secret) |
7+
| hashing.go:28:11:28:25 | secretByteSlice | hashing.go:28:11:28:25 | secretByteSlice | hashing.go:28:11:28:25 | secretByteSlice | $@ is used in a hashing algorithm (SHA1) that is insecure. | hashing.go:28:11:28:25 | secretByteSlice | Sensitive data (secret) |
8+
| hashing.go:30:16:30:30 | secretByteSlice | hashing.go:30:16:30:30 | secretByteSlice | hashing.go:30:16:30:30 | secretByteSlice | $@ is used in a hashing algorithm (MD4) that is insecure. | hashing.go:30:16:30:30 | secretByteSlice | Sensitive data (secret) |
9+
| hashing.go:31:22:31:36 | secretByteSlice | hashing.go:31:22:31:36 | secretByteSlice | hashing.go:31:22:31:36 | secretByteSlice | $@ is used in a hashing algorithm (RIPEMD160) that is insecure. | hashing.go:31:22:31:36 | secretByteSlice | Sensitive data (secret) |
10+
| hashing.go:82:23:82:38 | type conversion | hashing.go:82:30:82:37 | password | hashing.go:82:23:82:38 | type conversion | $@ is used in a hashing algorithm (SHA256) that is insecure for password hashing, since it is not a computationally expensive hash function. | hashing.go:82:30:82:37 | password | Sensitive data (password) |
1111
edges
12+
| hashing.go:82:30:82:37 | password | hashing.go:82:23:82:38 | type conversion | provenance | |
1213
nodes
13-
| hashing.go:20:8:20:22 | secretByteSlice | semmle.label | secretByteSlice |
14-
| hashing.go:21:10:21:24 | secretByteSlice | semmle.label | secretByteSlice |
15-
| hashing.go:22:20:22:31 | secretString | semmle.label | secretString |
14+
| hashing.go:22:8:22:22 | secretByteSlice | semmle.label | secretByteSlice |
1615
| hashing.go:23:10:23:24 | secretByteSlice | semmle.label | secretByteSlice |
17-
| hashing.go:25:17:25:31 | secretByteSlice | semmle.label | secretByteSlice |
18-
| hashing.go:26:11:26:25 | secretByteSlice | semmle.label | secretByteSlice |
19-
| hashing.go:28:16:28:30 | secretByteSlice | semmle.label | secretByteSlice |
20-
| hashing.go:29:22:29:36 | secretByteSlice | semmle.label | secretByteSlice |
21-
| hashing.go:80:16:80:23 | password | semmle.label | password |
16+
| hashing.go:24:20:24:31 | secretString | semmle.label | secretString |
17+
| hashing.go:25:10:25:24 | secretByteSlice | semmle.label | secretByteSlice |
18+
| hashing.go:27:17:27:31 | secretByteSlice | semmle.label | secretByteSlice |
19+
| hashing.go:28:11:28:25 | secretByteSlice | semmle.label | secretByteSlice |
20+
| hashing.go:30:16:30:30 | secretByteSlice | semmle.label | secretByteSlice |
21+
| hashing.go:31:22:31:36 | secretByteSlice | semmle.label | secretByteSlice |
22+
| hashing.go:82:23:82:38 | type conversion | semmle.label | type conversion |
23+
| hashing.go:82:30:82:37 | password | semmle.label | password |
2224
subpaths

‎go/ql/test/query-tests/Security/CWE-327/hashing.go‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ package main
55

66
import (
77
"crypto/md5"
8+
"crypto/pbkdf2"
9+
"crypto/rand"
810
"crypto/sha1"
911
"crypto/sha256"
1012
"crypto/sha3"
@@ -75,7 +77,15 @@ func StrongHashes() {
7577
sha3.SumSHAKE256(secretByteSlice, 100) // $ CryptographicOperation="SHAKE256. init from 0 lines above."
7678
}
7779

78-
func PasswordHashing() {
79-
password := []byte("")
80-
sha256.Sum256(password) // $ Alert[go/weak-sensitive-data-hashing] CryptographicOperation="SHA256. init from 0 lines above."
80+
func GetPasswordHashBad(password string) [32]byte {
81+
// BAD, SHA256 is a strong hashing algorithm but it is not computationally expensive
82+
return sha256.Sum256([]byte(password)) // $ Alert[go/weak-sensitive-data-hashing] CryptographicOperation="SHA256. init from 0 lines above."
83+
}
84+
85+
func GetPasswordHashGood(password string) []byte {
86+
// GOOD, PBKDF2 is a strong hashing algorithm and it is computationally expensive
87+
salt := make([]byte, 16)
88+
rand.Read(salt)
89+
key, _ := pbkdf2.Key(sha512.New, password, salt, 4096, 32)
90+
return key
8191
}

0 commit comments

Comments
 (0)