mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
Crypto: Remove redundant queries.
This commit is contained in:
@@ -1,22 +0,0 @@
|
||||
/**
|
||||
* @name Insecure nonce at a cipher operation
|
||||
* @id java/quantum/insecure-nonce
|
||||
* @description A nonce is generated from a source that is not secure. This can lead to
|
||||
* vulnerabilities such as replay attacks or key recovery.
|
||||
* @kind problem
|
||||
* @problem.severity error
|
||||
* @precision high
|
||||
* @tags quantum
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import experimental.quantum.Language
|
||||
|
||||
predicate isInsecureNonceSource(Crypto::NonceArtifactNode n, Crypto::NodeBase src) {
|
||||
src = n.getSourceNode() and
|
||||
not src.asElement() instanceof SecureRandomnessInstance
|
||||
}
|
||||
|
||||
from Crypto::KeyOperationNode op, Crypto::NodeBase src
|
||||
where isInsecureNonceSource(op.getANonce(), src)
|
||||
select op, "Operation uses insecure nonce source $@", src, src.toString()
|
||||
@@ -1,20 +0,0 @@
|
||||
/**
|
||||
* @name Weak known key derivation function iteration count
|
||||
* @description Detects key derivation operations with a known weak iteration count.
|
||||
* @id java/quantum/weak-kdf-iteration-count
|
||||
* @kind problem
|
||||
* @problem.severity error
|
||||
* @precision high
|
||||
* @tags quantum
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
import experimental.quantum.Language
|
||||
|
||||
from Crypto::KeyDerivationOperationNode op, Literal l
|
||||
where
|
||||
op.getIterationCount().asElement() = l and
|
||||
l.getValue().toInt() < 100000
|
||||
select op, "Key derivation operation configures iteration count below 100k: $@", l,
|
||||
l.getValue().toString()
|
||||
Reference in New Issue
Block a user