Description

This detector identifies insecure usage of the PBKDF2 key derivation function in TypeScript code where a predictable or static salt value is used. Using a predictable salt defeats the purpose of salting, making the derived keys vulnerable to precomputation attacks (e.g., rainbow tables) and weakening the overall cryptographic strength of password hashing or key derivation operations.

Detection Strategy

• Identifies calls to PBKDF2 functions (e.g., `crypto.pbkdf2`, `pbkdf2Sync`, or equivalent library wrappers) in TypeScript source files.

• Inspects the salt argument passed to the PBKDF2 call — a vulnerability is reported when the salt is determined to be a hardcoded literal (e.g., a string constant, numeric literal, or empty buffer), a static/constant variable whose value never changes at runtime, or any other value that is predictable and not cryptographically random.

• A vulnerability is NOT reported when the salt argument is derived from a cryptographically secure random source, such as `crypto.randomBytes()` or equivalent secure random generation APIs.

Vulnerable code example

import { pbkdf2Sync } from "pbkdf2";

export function hashPasswordWithClock(password: string): string {
  const salt: string = String(Date.now()); // BAD: predictable salt from timestamp
  const hash: Buffer = pbkdf2Sync(password, salt, 210000, 64, "sha512"); // vulnerable: weak salt

  return `${salt}:${hash.toString("hex")}`;
}...

✅ Secure code example

import * as crypto from "crypto";
import { pbkdf2Sync } from "pbkdf2";

export function hashPasswordWithClock(password: string): string {
  const salt: Buffer = crypto.randomBytes(16); // SAFE: cryptographically random salt
  const hash: Buffer = pbkdf2Sync(password, salt, 210000, 64, "sha512");

  return `${salt.toString("hex")}:${hash.toString("hex")}`;...