hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Updates to insecure or unknown nonce at operation.

Browse Source
This commit is contained in:
REDMOND\brodes
2025-03-03 14:42:50 -05:00
parent 076f53147d
commit 14cb2bb12f
1 changed files with 15 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
java/ql/src/experimental/Quantum/InsecureOrUnknownNonceAtOperation.ql
View File

@@ -6,52 +6,47 @@
import experimental.Quantum.Language
from Crypto::NonceNode n, Crypto::CipherOperationNode op, Crypto::FlowAwareElement src, string msg
where
op.getANonce() = n and
// Only encryption mode is relevant for insecure nonces, consder any 'unknown' subtype
// as possibly encryption.
(
op.getCipherOperationSubtype() instanceof Crypto::EncryptionSubtype
or
op.getCipherOperationSubtype() instanceof Crypto::WrapSubtype
or
op.getCipherOperationSubtype() instanceof Crypto::UnwrapSubtype
) and
(
// Known sources cases that are not secure
src = n.getSourceElement() and
not src instanceof SecureRandomnessInstance and
msg = "Operation uses insecure nonce source $@"
not src instanceof SecureRandomnessInstance and
msg = "Operation uses insecure nonce source $@"
or
// Totally unknown sources (unmodeled input sources)
not exists(n.getSourceElement()) and msg = "Operation uses unknown nonce source" and src = n.asElement()
not exists(n.getSourceElement()) and
msg = "Operation uses unknown nonce source" and
src = n.asElement()
)
select n, msg, src, src.toString()
// variant using instances, does not yield the same results
// from Crypto::NonceArtifactConsumer n, Crypto::CipherOperationInstance op, Crypto::FlowAwareElement src, string msg
// where
// op.getNonceConsumer() = n and
// TODO: only perform the query on encryption
// (
// // Known sources cases that are not secure
// src = n.getAKnownArtifactSource()and
// not src instanceof SecureRandomnessInstance and
// msg = "Operation uses insecure nonce source $@"
// or
// // Totally unknown sources (unmodeled input sources)
// // When this occurs set src to n, just to bind it, but the output message will not report any source
// not exists(n.getAKnownArtifactSource()) and msg = "Operation uses unknown nonce source" and src = n
// )
// select n, msg, src, src.toString()
// NOTE: this will find all unknowns too, constants, and allocations, without needing to model them
// which is kinda nice, but accidental, since getSourceElement is not modeled for everything
// If users want to find constants or unallocated, they need to model those sources, and output the
@@ -61,7 +56,6 @@ select n, msg, src, src.toString()
// will see the nonce and operation are secure, regardless of potentially insecure IV sources
// resulting in False Negatives
// NOTE: need to have a query where the op has no Nonce
// // Ideal query
// from Crypto::NonceNode n, Crypto::CipherOperationNode op
// where