ONebesky503272 (Community Member) asked a question.

Javascript crypto module is mistaken for mongoose

Run into this weird flaw with native crypto module in nodejs. Hashing function got flagged as unsafe SQL operation as "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"

 

Here is a simple example:

```

import crypto from 'crypto';

 

static fastHash(text: string) {

return crypto

.createHash('sha1')

.update(text) // this is the line with flaw

.digest('base64');

}

```

Is there a way to tell the static code analyzer to ignore this line of code? Thanks in advance!


VCode likes this.
  • Hi @ONebesky503272 (Community Member)​ ,

     

    It appears you may have run into an issue in the platform. I would ask you to please contact our technical support team so they can investigate.

     

    Here's how you can log a case:

     

    1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
    2. Select Contact Support from the drop-down menu.

     

    Best regards,

    Duncan

    Expand Post

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.