hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14040 from egregius313/egregius313/weak-hashing-properties

Browse Source 
Java: Add support for algorithm names specified in `.properties` files to `java/potentially-weak-cryptographic-algorithm`
This commit is contained in:
Edward Minnix III
2023-12-18 09:38:58 -05:00
committed by GitHub
parent d5f47a3d75 0524289a73
commit 56921a6e21
7 changed files with 78 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/test/query-tests/security/CWE-327/semmle/tests/MaybeBrokenCryptoAlgorithm.expected
View File

@@ -1,6 +1,8 @@
edges
nodes
| Test.java:34:48:34:52 | "foo" | semmle.label | "foo" |
| WeakHashing.java:15:55:15:83 | getProperty(...) | semmle.label | getProperty(...) |
subpaths
#select
| Test.java:34:21:34:53 | new SecretKeySpec(...) | Test.java:34:48:34:52 | "foo" | Test.java:34:48:34:52 | "foo" | Cryptographic algorithm $@ may not be secure, consider using a different algorithm. | Test.java:34:48:34:52 | "foo" | foo |
| WeakHashing.java:15:29:15:84 | getInstance(...) | WeakHashing.java:15:55:15:83 | getProperty(...) | WeakHashing.java:15:55:15:83 | getProperty(...) | Cryptographic algorithm $@ may not be secure, consider using a different algorithm. | WeakHashing.java:15:55:15:83 | getProperty(...) | MD5 |

20
java/ql/test/query-tests/security/CWE-327/semmle/tests/WeakHashing.java Normal file
View File

@@ -0,0 +1,20 @@
package test.cwe327.semmle.tests;
import java.util.Properties;
import java.io.FileInputStream;
import java.io.IOException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
public class WeakHashing {
void hashing() throws NoSuchAlgorithmException, IOException {
java.util.Properties props = new java.util.Properties();
props.load(new FileInputStream("example.properties"));
// BAD: Using a weak hashing algorithm
MessageDigest bad = MessageDigest.getInstance(props.getProperty("hashAlg1"));
// GOOD: Using a strong hashing algorithm
MessageDigest ok = MessageDigest.getInstance(props.getProperty("hashAlg2"));
}
}

2
java/ql/test/query-tests/security/CWE-327/semmle/tests/example.properties Normal file
View File

@@ -0,0 +1,2 @@
hashAlg1=MD5
hashAlg2=SHA-256