Description

This detector identifies hardcoded salt values used in bcrypt password hashing functions in Rust code. Using static, hardcoded salts defeats the purpose of salting, making password hashes vulnerable to rainbow table attacks and reducing the security benefit of bcrypt hashing.

Detection Strategy

• Scans Rust code that imports the bcrypt crate (or related bcrypt libraries)

• Identifies calls to bcrypt salt generation or hashing functions that accept a salt parameter

• Analyzes the salt argument (typically the second parameter) to determine if it contains a hardcoded value

• Reports a vulnerability when the salt parameter is traced back to a static string literal, constant, or other hardcoded value rather than being dynamically generated

Vulnerable code example

use bcrypt::hash_with_salt;

fn hash_password_hardcoded_salt(password: &str) -> bcrypt::HashParts {
    // Vulnerable: hardcoded salt makes hashes predictable
    hash_with_salt(password, 12, *b"fixedsalt123456").unwrap()
}

✅ Secure code example

use bcrypt::hash_with_salt;
use rand::{rngs::OsRng, RngCore};

fn hash_password_hardcoded_salt(password: &str) -> bcrypt::HashParts {
    // Safe: generate random salt using OS randomness
    let mut salt = [0u8; 16];
    OsRng.fill_bytes(&mut salt);
    hash_with_salt(password, 12, salt).unwrap()...