Description

This detector identifies TypeScript code that uses Node.js crypto functions with empty or missing passwords/passphrases. Empty passwords in cryptographic operations provide no security benefit and make encrypted data vulnerable to trivial attacks, essentially equivalent to storing data in plaintext.

Detection Strategy

• The detector searches for calls to Node.js crypto module functions that accept password or passphrase parameters

• It identifies when these cryptographic functions are invoked with empty strings, null values, or missing password arguments

• Common vulnerable patterns include crypto.createCipher('algorithm', ''), crypto.pbkdf2() with empty password, or crypto.scrypt() without proper password parameters

• The vulnerability is reported when cryptographic operations are performed without meaningful password protection

Vulnerable code example

import * as crypto from 'crypto';

// Vulnerable: using empty password in PBKDF2
function weakCrypto(): Buffer {
    return crypto.pbkdf2Sync(
        "", // Empty password provides no security
        "salt",
        1000,...

✅ Secure code example

import * as crypto from 'crypto';

// Secure: validating password before PBKDF2
function secureCrypto(password: string): Buffer {
    if (!password) throw new Error("Password required"); // Prevent empty passwords
    
    return crypto.pbkdf2Sync(
        password, // Safe: validated non-empty password...