Commit 20030d5
File tree
- python/ql
- src/experimental/Security/CWE-208/TimingAttackAgainstHash
- test/experimental/query-tests/Security/CWE-208/TimingAttackAgainstHash
Lines changed: 3 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -26,6 +26,8 @@ private module PossibleTimingAttackAgainstHashConfig implements DataFlow::Config | |||
| 26 | 26 | predicate isSource(DataFlow::Node source) { source instanceof ProduceCryptoCall } | |
| 27 | 27 | ||
| 28 | 28 | predicate isSink(DataFlow::Node sink) { sink instanceof NonConstantTimeComparisonSink } | |
| 29 | + | ||
| 30 | + predicate observeDiffInformedIncrementalMode() { any() } | ||
| 29 | 31 | } | |
| 30 | 32 | ||
| 31 | 33 | module PossibleTimingAttackAgainstHashFlow = | |
@@ -38,4 +40,4 @@ from | |||
| 38 | 40 | PossibleTimingAttackAgainstHashFlow::PathNode sink | |
| 39 | 41 | where PossibleTimingAttackAgainstHashFlow::flowPath(source, sink) | |
| 40 | 42 | select sink.getNode(), source, sink, "Possible Timing attack against $@ validation.", | |
| 41 | - source.getNode().(ProduceCryptoCall).getResultType(), "message" | ||
| 43 | + source.getNode(), source.getNode().(ProduceCryptoCall).getResultType() + " message" | ||
Lines changed: 4 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -25,6 +25,8 @@ private module TimingAttackAgainstHashConfig implements DataFlow::ConfigSig { | |||
| 25 | 25 | predicate isSource(DataFlow::Node source) { source instanceof ProduceCryptoCall } | |
| 26 | 26 | ||
| 27 | 27 | predicate isSink(DataFlow::Node sink) { sink instanceof NonConstantTimeComparisonSink } | |
| 28 | + | ||
| 29 | + predicate observeDiffInformedIncrementalMode() { any() } | ||
| 28 | 30 | } | |
| 29 | 31 | ||
| 30 | 32 | module TimingAttackAgainstHashFlow = TaintTracking::Global<TimingAttackAgainstHashConfig>; | |
@@ -35,5 +37,5 @@ from TimingAttackAgainstHashFlow::PathNode source, TimingAttackAgainstHashFlow:: | |||
| 35 | 37 | where | |
| 36 | 38 | TimingAttackAgainstHashFlow::flowPath(source, sink) and | |
| 37 | 39 | sink.getNode().(NonConstantTimeComparisonSink).includesUserInput() | |
| 38 | - select sink.getNode(), source, sink, "Timing attack against $@ validation.", | ||
| 39 | - source.getNode().(ProduceCryptoCall).getResultType(), "message" | ||
| 40 | + select sink.getNode(), source, sink, "Timing attack against $@ validation.", source.getNode(), | ||
| 41 | + source.getNode().(ProduceCryptoCall).getResultType() + " message" | ||
Lines changed: 2 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -10,5 +10,5 @@ nodes | |||
| 10 | 10 | | TimingAttackAgainstHash.py:37:19:37:48 | ControlFlowNode for sign() | semmle.label | ControlFlowNode for sign() | | |
| 11 | 11 | subpaths | |
| 12 | 12 | #select | |
| 13 | - | TimingAttackAgainstHash.py:27:24:27:32 | ControlFlowNode for signature | TimingAttackAgainstHash.py:26:17:26:41 | ControlFlowNode for Attribute() | TimingAttackAgainstHash.py:27:24:27:32 | ControlFlowNode for signature | Possible Timing attack against $@ validation. | signature | message | | ||
| 14 | - | TimingAttackAgainstHash.py:37:19:37:48 | ControlFlowNode for sign() | TimingAttackAgainstHash.py:30:12:30:47 | ControlFlowNode for Attribute() | TimingAttackAgainstHash.py:37:19:37:48 | ControlFlowNode for sign() | Possible Timing attack against $@ validation. | MAC | message | | ||
| 13 | + | TimingAttackAgainstHash.py:27:24:27:32 | ControlFlowNode for signature | TimingAttackAgainstHash.py:26:17:26:41 | ControlFlowNode for Attribute() | TimingAttackAgainstHash.py:27:24:27:32 | ControlFlowNode for signature | Possible Timing attack against $@ validation. | TimingAttackAgainstHash.py:26:17:26:41 | ControlFlowNode for Attribute() | signature message | | ||
| 14 | + | TimingAttackAgainstHash.py:37:19:37:48 | ControlFlowNode for sign() | TimingAttackAgainstHash.py:30:12:30:47 | ControlFlowNode for Attribute() | TimingAttackAgainstHash.py:37:19:37:48 | ControlFlowNode for sign() | Possible Timing attack against $@ validation. | TimingAttackAgainstHash.py:30:12:30:47 | ControlFlowNode for Attribute() | MAC message | | ||
0 commit comments