General issue: CWE-208 coverage for javascript
- Ngôn ngữ chính
- CodeQL
- Star
- 10.1k
- Fork
- 2.1k
- Merge trung bình
- 2 ngày 15 giờ
- Pull request đã merge (30 ngày)
- 141
Mô tả
**Description**
CodeQL currently does not detect CWE-208 (Observable Timing Discrepancy) in JavaScript/TypeScript, while this weakness is covered in Java/Kotlin, Python and Ruby. This appears to be a language coverage gap rather than a configuration issue. [https://codeql.github.com/codeql-query-help/full-cwe/]
**Example**
In authentication or validation logic, I would expect CodeQL to at least be able
to model potential timing differences, for example:
``` js
if (value !== expectedValue) {
return res.status(401).json({ message: 'Invalid token' });
}
```
**Question**
Is there a plan to expand CodeQL query coverage for this weakness in the remaining languages?
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.