id: JS-SEC-046
name: timing-attack
severity: medium
language: javascript
cwe: CWE-208
owasp: "A02:2021"
description: "Detect direct string comparison of secrets, tokens, or API keys which is vulnerable to timing attacks."
pattern:
  type: regex
  regex:
    - '(?i)(token|secret|api_key|apiKey|password|hash|signature)\s*===?\s*'
    - '(?i)(token|secret|api_key|apiKey|password|hash|signature)\s*!==?\s*'
message: "Non-constant-time comparison of security-sensitive value detected. Timing differences enable attackers to guess secrets byte-by-byte."
fix_hint: "Use crypto.timingSafeEqual() for comparing secrets, tokens, and hashes."
references:
  - https://cwe.mitre.org/data/definitions/208.html
  - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
