hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 15:25:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update query metadata

Browse Source 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
This commit is contained in:
Edward Minnix III
2023-11-14 13:19:48 -05:00
committed by Ed Minnix
parent bbf99375c7
commit 4678302edb
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
java/ql/src/Security/CWE/CWE-330/WeakRandomness.ql
View File

@@ -1,11 +1,13 @@
/**
* @name Weak Randomness
* @description Using a weak source of randomness may allow an attacker to predict the generated values.
* @name Insecure randomness
* @description Using a cryptographically weak pseudo-random number generator to generate a
* security-sensitive value may allow an attacker to predict what value will
* be generated.
* @kind path-problem
* @problem.severity error
* @security-severity 8.6
* @problem.severity warning
* @security-severity 7.8
* @precision high
* @id java/weak-randomness
* @id java/insecure-randomness
* @tags security
* external/cwe/cwe-330
* external/cwe/cwe-338

2
java/ql/src/change-notes/2023-11-08-weak-randomness-query.md
View File

@@ -1,5 +1,5 @@
---
category: newQuery
---
* Added the `java/weak-randomness` query to detect uses of weakly random values which an attacker may be able to predict. Also added the `crypto-parameter` sink kind for sinks which represent the parameters and keys of cryptographic operations.
* Added the `java/insecure-randomness` query to detect uses of weakly random values which an attacker may be able to predict. Also added the `crypto-parameter` sink kind for sinks which represent the parameters and keys of cryptographic operations.