javascript-cryptographic-failures

JavaScript Cryptographic Failures (OWASP A02:2021)

actions:

• type: enforce conditions:

  Pattern 1: Weak or insecure cryptographic algorithms

  • pattern: "(?:createHash|crypto\.createHash)\('"['"]\)|(?:crypto|require\(['"]crypto['"]\))\.(?:createHash|Hash)\('"['"]\)|new (?:MD5|SHA1)\(|CryptoJS\.(?:MD5|SHA1)\(" message: "Using weak hashing algorithms (MD5/SHA1). Use SHA-256 or stronger algorithms."

  Pattern 2: Hardcoded secrets/credentials

  • pattern: "(?:const|let|var)\s+(?:password|secret|key|token|auth|apiKey|api_key)\s*=\s*['"][^'"]+['"]" message: "Potential hardcoded credentials detected. Store secrets in environment variables or a secure vault."

  Pattern 3: Insecure random number generation

  • pattern: "Math\.random\(\)|Math\.floor\(\sMath\.random\(\)\s\*" message: "Using Math.random() for security purposes. Use crypto.randomBytes() or Web Crypto API for cryptographic operations."

  Pattern 4: Weak SSL/TLS configuration

  • pattern: "(?:tls|https|require\(['"]https['"]\)|require\(['"]tls['"]\))\.(?:createServer|request|get)\([^\)]?{[^}]?secureProtocol\s*:\s*'"['"]" message: "Using deprecated/insecure SSL/TLS protocol versions. Use TLS 1.2+ for secure communications."

  Pattern 5: Missing certificate validation

  • pattern: "(?:rejectUnauthorized|strictSSL)\s*:\s*false" message: "SSL certificate validation is disabled. Always validate certificates in production environments."

  Pattern 6: Insecure cipher usage

  • pattern: "(?:createCipheriv|crypto\.createCipheriv)\('"['"]" message: "Using insecure encryption cipher or mode. Use AES with GCM or CBC mode with proper padding."

  Pattern 7: Insufficient key length

  • pattern: "(?:generateKeyPair|generateKeyPairSync)\([^,]?['"]rsa['"][^,]?{[^}]?modulusLength\s:\s*(\d{1,3}|1[0-9]{3}|20[0-3][0-9]|204[0-7])\s*}" message: "Using insufficient key length for asymmetric encryption. RSA keys should be at least 2048 bits, preferably 4096 bits."

  Pattern 8: Insecure password hashing

  • pattern: "(?:createHash|crypto\.createHash)\([^)]?\)\.(?:update|digest)\([^)]?\)|CryptoJS\.(?:SHA256|SHA512|SHA3)\([^)]*?\)" negative_pattern: "(?:bcrypt|scrypt|pbkdf2|argon2)" message: "Using plain hashing for passwords. Use dedicated password hashing functions like bcrypt, scrypt, or PBKDF2."

  Pattern 9: Missing salt in password hashing

  • pattern: "(?:pbkdf2|pbkdf2Sync)\([^,]+,[^,]+,[^,]+,\s*\d+\s*,[^,]+\)" negative_pattern: "(?:salt|crypto\.randomBytes)" message: "Ensure you're using a proper random salt with password hashing functions."

  Pattern 10: Insecure cookie settings

  • pattern: "(?:document\.cookie|cookies\.set|res\.cookie|cookie\.serialize)\([^)]?\)" negative_pattern: "(?:secure\s:|httpOnly\s*:|sameSite\s*:)" message: "Cookies with sensitive data should have secure and httpOnly flags enabled."

  Pattern 11: Client-side encryption

  • pattern: "(?:encrypt|decrypt|createCipher|createDecipher)\([^)]*?\)" location: "(?:frontend|client|browser|react|vue|angular)" message: "Performing sensitive cryptographic operations on the client side. Move encryption/decryption logic to the server."

  Pattern 12: Insecure JWT implementation

  • pattern: "(?:jwt\.sign|jsonwebtoken\.sign)\([^,]?,[^,]?,[^\)]?\)" negative_pattern: "(?:expiresIn|algorithm\s:\s*'"['"])" message: "JWT implementation missing expiration or using weak algorithm. Set expiresIn and use a strong algorithm."