Swift: Add CryptoSwift sinks in swift/weak-sensitive-data-hashing#12824
Swift: Add CryptoSwift sinks in swift/weak-sensitive-data-hashing#12824geoffw0 merged 5 commits intogithub:mainfrom
Conversation
…esults. Overall this doesn't give us any new results in tests, but makes paths shorter, and in the real world I expect it to add reliability.
|
I think the QLDoc check warnings are wrong (due to lacking support for modules): |
MathiasVP
left a comment
There was a problem hiding this comment.
LGTM! Remembering the amount of trouble the Ruby team had when they started to raise alerts on uses of md5: Should we maybe run this on MRVA before we merge this and have a quick look at the results? (IIRC, the Ruby query didn't have a concept of "sensitive data", so we're in a bit of a better position than they are with the query).
|
Yes, I believe the issue was that it was flagging more-or-less any use of MD5 with the idea that the algorithm is insecure - but in practice it is widely used for non-cryptographic purposes. The restriction to sensitive data should exclude the vast majority of such non-cryptographic uses. Also note that we already flag the Nevertheless I will do a MRVA run later today out of an abundance of caution. |
|
In the top 1000 MRVA projects (actually 808 projects) I found 4 new results, all in one project. Two cases in a function hashing a password + salt with |
This was fairly straightforward now that we have CSV sinks in the query. I think it's quite a big win for the coverage of this query.