Description

Detects the use of hardcoded or static salt values in PHP's hash_pbkdf2 function. Using a predictable or hardcoded salt undermines the security of password hashing by making it vulnerable to precomputed rainbow table attacks.

Detection Strategy

• Identify calls to PHP's hash_pbkdf2 function

• Examine the third parameter (salt) of the function call

• Flag cases where the salt is a hardcoded string literal

• Flag cases where the salt is a variable that can be traced back to a hardcoded string assignment

Vulnerable code example

<?php

// VULNERABLE: Salt is an inline string literal
function unsafe_inline_salt(string $password): string
{
    return hash_pbkdf2('sha256', $password, 'static_salt', 100000);
}
...

✅ Secure code example

<?php

// SAFE: Salt generated from random_bytes()
function safe_random_bytes(string $password): string
{
    $salt = random_bytes(16);
    return hash_pbkdf2('sha256', $password, $salt, 100000);
}...