@nodesecure/js-x-ray/dist/probes/crypto/isWeakAlgorithm.js

JavaScript AST XRay analysis

import { CALL_EXPRESSION_DATA } from "../../contants.js";
import { isStringLiteral } from "../../estree/types.js";
import { generateWarning } from "../../warnings.js";
// CONSTANTS
const kWeakAlgorithms = new Set([
    "md5",
    "sha1",
    "ripemd160",
    "md4",
    "md2"
]);
const kTracedFunctions = new Set([
    "crypto.createHash",
    "crypto.createHmac"
]);
function validateNode(_node, ctx) {
    const { tracer } = ctx.sourceFile;
    if (!tracer.importedModules.has("crypto")) {
        return [false];
    }
    return [
        kTracedFunctions.has(ctx.context[CALL_EXPRESSION_DATA]?.identifierOrMemberExpr)
    ];
}
function initialize(ctx) {
    const { tracer } = ctx.sourceFile;
    for (const identifierOrMemberExpr of kTracedFunctions) {
        tracer.trace(identifierOrMemberExpr, {
            followConsecutiveAssignment: true,
            moduleName: "crypto"
        });
    }
}
function main(node, ctx) {
    const { sourceFile } = ctx;
    const arg = node.arguments.at(0);
    if (isStringLiteral(arg) && kWeakAlgorithms.has(arg.value)) {
        const warning = generateWarning("crypto.weak-algorithm", { value: arg.value, location: node.loc });
        sourceFile.warnings.push(warning);
    }
}
export default {
    name: "isWeakCrypto",
    nodeTypes: ["CallExpression"],
    validateNode,
    main,
    initialize,
    breakOnMatch: false,
    context: {}
};
//# sourceMappingURL=isWeakAlgorithm.js.map