hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 15:25:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Move some logic to class

Browse Source
This commit is contained in:
Ed Minnix
2023-08-23 10:33:23 -04:00
parent 4ff6c1e2ea
commit 25fa8d5ae7
1 changed files with 5 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
java/ql/lib/semmle/code/java/security/WeakHashingAlgorithmPropertyQuery.qll
View File

@@ -8,20 +8,19 @@ private import semmle.code.java.security.Encryption
private import semmle.code.java.frameworks.Properties
private import semmle.code.java.dataflow.RangeUtils
class GetPropertyMethodAccess extends MethodAccess {
private class GetPropertyMethodAccess extends MethodAccess {
GetPropertyMethodAccess() { this.getMethod() instanceof PropertiesGetPropertyMethod }
private ConfigPair getPair() {
this.getArgument(0).(ConstantStringExpr).getStringValue() = result.getNameElement().getName()
}
string getValue() {
string getPropertyValue() {
result = this.getPair().getValueElement().getValue() or
result = this.getArgument(1).(ConstantStringExpr).getStringValue()
}
}
string getWeakHashingAlgorithm(DataFlow::Node node) {
/**
* Get the name of the weak cryptographic algorithm represented by `node`.
*/
@@ -40,11 +39,9 @@ string getWeakHashingAlgorithmName(DataFlow::Node node) {
*/
module InsecureAlgorithmPropertyConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node n) {
exists(MethodAccess ma, ConfigPair pair |
n.asExpr() = ma and ma.getMethod() instanceof PropertiesGetPropertyMethod
|
ma.getArgument(0).(ConstantStringExpr).getStringValue() = pair.getNameElement().getName() and
not pair.getValueElement().getValue().regexpMatch(getSecureAlgorithmRegex())
exists(GetPropertyMethodAccess ma, string algo | n.asExpr() = ma |
algo = ma.getPropertyValue() and
not algo.regexpMatch(getSecureAlgorithmRegex())
)
}