General issue: CWE-208 coverage for javascript
- Linguagem predominante
- CodeQL
- Estrelas
- 10.1k
- Forks
- 2.1k
- Merge médio
- 2d 15h
- PRs com merge (30d)
- 141
Descrição
**Description**
CodeQL currently does not detect CWE-208 (Observable Timing Discrepancy) in JavaScript/TypeScript, while this weakness is covered in Java/Kotlin, Python and Ruby. This appears to be a language coverage gap rather than a configuration issue. [https://codeql.github.com/codeql-query-help/full-cwe/]
**Example**
In authentication or validation logic, I would expect CodeQL to at least be able
to model potential timing differences, for example:
``` js
if (value !== expectedValue) {
return res.status(401).json({ message: 'Invalid token' });
}
```
**Question**
Is there a plan to expand CodeQL query coverage for this weakness in the remaining languages?
Guia de contribuição
Direção de pesquisa
Start with the CodeQL query help page for full CWE coverage and compare CWE-208 support in Java/Kotlin, Python, and Ruby with the JavaScript/TypeScript gap described here. Clarify the intended coverage and implementation scope; done would mean an agreed plan or added CWE-208 coverage for JavaScript/TypeScript.
Escrita pelo modelo de indexação a partir do texto da issue.
Avaliação
- Stack de tecnologia
- javascript, typescript
- Domínio
- security
- Tipo de issue
- Funcionalidade
- Dificuldade
- 5/5
- Tempo estimado
- Mais de uma semana
- Status de atividade
- Estagnada
- Clareza
- Precisa de esclarecimento
- Facilidade para iniciantes
- 25/100