Skip to content

Commit

Permalink
Update timing_attack_node.yaml (#113)
Browse files Browse the repository at this point in the history
Add more explanation about the attack. 
Remove Snyk reference. 
Add NodeJs reference.
  • Loading branch information
sebasrevuelta authored Mar 13, 2024
1 parent 5cbf144 commit 40ff09e
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion njsscan/rules/semantic_grep/crypto/timing_attack_node.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -485,7 +485,8 @@ rules:
return api != $X;
message: >-
String comparisons using '===', '!==', '!=' and '==' is vulnerable to timing attacks.
More info: https://snyk.io/blog/node-js-timing-attack-ccc-ctf/
A timing attack allows the attacker to learn potentially sensitive information by, for example, measuring how long it takes for the application to respond to a request.
More info: https://nodejs.org/en/learn/getting-started/security-best-practices#information-exposure-through-timing-attacks-cwe-208
languages:
- javascript
severity: WARNING
Expand Down

0 comments on commit 40ff09e

Please sign in to comment.