hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-18 13:34:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Rust: Fix typo.

Browse Source
This commit is contained in:
Geoffrey White
2025-03-06 19:09:01 +00:00
parent 9af2d0218b
commit 42e7d1e983
2 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql
View File

@@ -6,7 +6,7 @@
* @problem.severity warning
* @security-severity 9.8
* @precision high
* @id rust/hardcoded-crytographic-value
* @id rust/hardcoded-cryptographic-value
* @tags security
* external/cwe/cwe-259
* external/cwe/cwe-321

36
rust/ql/test/query-tests/security/CWE-798/test_cipher.rs
View File

@@ -15,18 +15,18 @@ fn test_stream_cipher_rabbit(
let mut rabbit_cipher1 = RabbitKeyOnly::new(rabbit::Key::from_slice(key));
rabbit_cipher1.apply_keystream(&mut data);
let const1: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-crytographic-value]
let const1: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-cryptographic-value]
let mut rabbit_cipher2 = RabbitKeyOnly::new(rabbit::Key::from_slice(const1)); // $ Sink
rabbit_cipher2.apply_keystream(&mut data);
let mut rabbit_cipher3 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(iv));
rabbit_cipher3.apply_keystream(&mut data);
let const4: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-crytographic-value]
let const4: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-cryptographic-value]
let mut rabbit_cipher4 = Rabbit::new(rabbit::Key::from_slice(const4), rabbit::Iv::from_slice(iv)); // $ Sink
rabbit_cipher4.apply_keystream(&mut data);
let const5: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-crytographic-value]
let const5: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-cryptographic-value]
let mut rabbit_cipher5 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(const5)); // $ Sink
rabbit_cipher5.apply_keystream(&mut data);
@@ -34,20 +34,20 @@ fn test_stream_cipher_rabbit(
let const6: &[u8;16] = &[0u8;16]; // (unused, so good)
let const7: [u8;16] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-crytographic-value]
let const7: [u8;16] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-cryptographic-value]
let mut rabbit_cipher7 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const7)); // $ Sink
rabbit_cipher7.apply_keystream(&mut data);
let const8: &[u8;16] = &[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-crytographic-value]
let const8: &[u8;16] = &[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-cryptographic-value]
let mut rabbit_cipher8 = RabbitKeyOnly::new(rabbit::Key::from_slice(const8)); // $ Sink
rabbit_cipher8.apply_keystream(&mut data);
let const9: [u16;8] = [0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-crytographic-value]
let const9: [u16;8] = [0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-cryptographic-value]
let const9_conv = unsafe { const9.align_to::<u8>().1 }; // convert [u16;8] -> [u8;8]
let mut rabbit_cipher9 = RabbitKeyOnly::new(rabbit::Key::from_slice(const9_conv)); // $ Sink
rabbit_cipher9.apply_keystream(&mut data);
let const10: [u8;16] = unsafe { std::mem::zeroed() }; // $ Alert[rust/hardcoded-crytographic-value]
let const10: [u8;16] = unsafe { std::mem::zeroed() }; // $ Alert[rust/hardcoded-cryptographic-value]
let mut rabbit_cipher10 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const10)); // $ Sink
rabbit_cipher10.apply_keystream(&mut data);
}
@@ -63,25 +63,25 @@ fn test_block_cipher_aes(
let aes_cipher1 = Aes256::new(key256.into());
aes_cipher1.encrypt_block(block128.into());
let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-crytographic-value]
let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-cryptographic-value]
let aes_cipher2 = Aes256::new(const2.into()); // $ Sink
aes_cipher2.encrypt_block(block128.into());
let aes_cipher3 = Aes256::new_from_slice(key256).unwrap();
aes_cipher3.encrypt_block(block128.into());
let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-crytographic-value]
let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-cryptographic-value]
let aes_cipher4 = Aes256::new_from_slice(const2).unwrap(); // $ Sink
aes_cipher4.encrypt_block(block128.into());
let aes_cipher5 = cfb_mode::Encryptor::<aes::Aes256>::new(key.into(), iv.into());
_ = aes_cipher5.encrypt_b2b(input, output).unwrap();
let const6 = &[0u8;32]; // $ Alert[rust/hardcoded-crytographic-value]
let const6 = &[0u8;32]; // $ Alert[rust/hardcoded-cryptographic-value]
let aes_cipher6 = cfb_mode::Encryptor::<aes::Aes256>::new(const6.into(), iv.into()); // $ Sink
_ = aes_cipher6.encrypt_b2b(input, output).unwrap();
let const7 = &[0u8; 16]; // $ Alert[rust/hardcoded-crytographic-value]
let const7 = &[0u8; 16]; // $ Alert[rust/hardcoded-cryptographic-value]
let aes_cipher7 = cfb_mode::Encryptor::<aes::Aes256>::new(key.into(), const7.into()); // $ Sink
_ = aes_cipher7.encrypt_b2b(input, output).unwrap();
@@ -91,18 +91,18 @@ fn test_block_cipher_aes(
let aes_cipher8 = cfb_mode::Encryptor::<aes::Aes256>::new(key8.into(), iv.into());
_ = aes_cipher8.encrypt_b2b(input, output).unwrap();
let key9: &[u8] = "1234567890123456".as_bytes(); // $ MISSING: Alert[rust/hardcoded-crytographic-value]
let key9: &[u8] = "1234567890123456".as_bytes(); // $ MISSING: Alert[rust/hardcoded-cryptographic-value]
let aes_cipher9 = cfb_mode::Encryptor::<aes::Aes256>::new(key9.into(), iv.into());
_ = aes_cipher9.encrypt_b2b(input, output).unwrap();
let key10: [u8; 32] = match base64::engine::general_purpose::STANDARD.decode(key_str) {
Ok(x) => x.try_into().unwrap(),
Err(_) => "1234567890123456".as_bytes().try_into().unwrap() // $ MISSING: Alert[rust/hardcoded-crytographic-value]
Err(_) => "1234567890123456".as_bytes().try_into().unwrap() // $ MISSING: Alert[rust/hardcoded-cryptographic-value]
};
let aes_cipher10 = Aes256::new(&key10.into());
aes_cipher10.encrypt_block(block128.into());
if let Ok(const11) = base64::engine::general_purpose::STANDARD.decode("1234567890123456") { // $ MISSING: Alert[rust/hardcoded-crytographic-value]
if let Ok(const11) = base64::engine::general_purpose::STANDARD.decode("1234567890123456") { // $ MISSING: Alert[rust/hardcoded-cryptographic-value]
let key11: [u8; 32] = const11.try_into().unwrap();
let aes_cipher11 = Aes256::new(&key11.into());
aes_cipher11.encrypt_block(block128.into());
@@ -121,14 +121,14 @@ fn test_aes_gcm(
let cipher1 = Aes256Gcm::new(&key1);
let _ = cipher1.encrypt(&nonce1, b"plaintext".as_ref()).unwrap();
let key2: [u8;32] = [0;32]; // $ Alert[rust/hardcoded-crytographic-value]
let nonce2 = [0;12]; // $ Alert[rust/hardcoded-crytographic-value]
let key2: [u8;32] = [0;32]; // $ Alert[rust/hardcoded-cryptographic-value]
let nonce2 = [0;12]; // $ Alert[rust/hardcoded-cryptographic-value]
let cipher2 = Aes256Gcm::new(&key2.into()); // $ Sink
let _ = cipher2.encrypt(&nonce2.into(), b"plaintext".as_ref()).unwrap(); // $ Sink
let key3_array: &[u8;32] = &[0xff;32]; // $ Alert[rust/hardcoded-crytographic-value]
let key3_array: &[u8;32] = &[0xff;32]; // $ Alert[rust/hardcoded-cryptographic-value]
let key3 = Key::<Aes256Gcm>::from_slice(key3_array);
let nonce3: [u8;12] = [0xff;12]; // $ Alert[rust/hardcoded-crytographic-value]
let nonce3: [u8;12] = [0xff;12]; // $ Alert[rust/hardcoded-cryptographic-value]
let cipher3 = Aes256Gcm::new(&key3); // $ Sink
let _ = cipher3.encrypt(&nonce3.into(), b"plaintext".as_ref()).unwrap(); // $ Sink
}