Description

This vulnerability detector identifies unsafe usage of bcrypt password hashing where empty or potentially unsafe values may be passed to the bcrypt.hash() function. Empty passwords or null values can bypass authentication mechanisms or create predictable hashes, compromising application security.

Detection Strategy

• The detector searches for calls to bcrypt.hash() method in TypeScript code

• It identifies the bcrypt library alias (typically 'bcrypt' but could be any imported name)

• The detector flags bcrypt.hash() calls that are deemed unsafe based on the arguments passed

• Specifically targets scenarios where empty strings, null values, or other unsafe inputs are provided as the password parameter to bcrypt.hash()

Vulnerable code example

import * as bcrypt from 'bcrypt';

async function vulnerableHash(): Promise<string> {
    return await bcrypt.hash("", 10); // Vulnerable: hashing empty password
}

✅ Secure code example

import * as bcrypt from 'bcrypt';

async function secureHash(password: string): Promise<string> {
    if (!password || password.length === 0) { // Validate password is not empty
        throw new Error("Password must not be empty");
    }
    return await bcrypt.hash(password, 10); // Safe: hash validated non-empty password
}