mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
Crypto: Removing non-ascii characters from unit tests
This commit is contained in:
@@ -24,7 +24,7 @@ import java.util.Base64;
|
||||
* - Brainpool (e.g., brainpoolP256r1)
|
||||
* - CURVE25519 (for X25519 key agreement)
|
||||
* - ES (e.g., Ed25519 for signatures)
|
||||
* - Other fallback (e.g., secp256r1 for “OtherEllipticCurveType”)
|
||||
* - Other fallback (e.g., secp256r1 for "OtherEllipticCurveType")
|
||||
*
|
||||
* Best practices:
|
||||
* - Use ephemeral keys and a strong RNG.
|
||||
|
||||
@@ -28,7 +28,7 @@ import java.util.Properties;
|
||||
* 1. PBKDF2 Examples:
|
||||
* - Parent Classification: Password-Based Key Derivation Function (PBKDF).
|
||||
* - SAST:
|
||||
* * pbkdf2DerivationBasic: Uses PBKDF2WithHmacSHA256 with 10,000 iterations –
|
||||
* * pbkdf2DerivationBasic: Uses PBKDF2WithHmacSHA256 with 10,000 iterations -
|
||||
* acceptable if parameters meet current standards.
|
||||
* * pbkdf2LowIteration: Uses only 10 iterations – flagged as insecure due to
|
||||
* insufficient iteration count.
|
||||
|
||||
@@ -15,7 +15,7 @@ import java.util.Base64;
|
||||
|
||||
/**
|
||||
* MACOperation demonstrates various Message Authentication Code (MAC)
|
||||
* operations and further use of MAC outputs as inputs into higher‐level
|
||||
* operations and further use of MAC outputs as inputs into higher-level
|
||||
* cryptosystems.
|
||||
*
|
||||
* Flows include:
|
||||
|
||||
@@ -143,7 +143,7 @@ public class SignEncryptCombinations {
|
||||
* UNSAFE FLOW: Signs the plaintext and encrypts only the signature.
|
||||
*
|
||||
* <p>
|
||||
* **Issue:** The plaintext message is not encrypted—only the signature is.
|
||||
* **Issue:** The plaintext message is not encrypted, only the signature is.
|
||||
* This exposes the original message to eavesdroppers and negates the purpose of
|
||||
* encryption.
|
||||
* </p>
|
||||
|
||||
@@ -235,22 +235,6 @@ public class SignatureOperation {
|
||||
System.out.println("Empty message signature verified? " + verified);
|
||||
}
|
||||
|
||||
/**
|
||||
* Demonstrates signing and verifying data containing non-ASCII characters.
|
||||
*
|
||||
* CBOM/SAST Notes:
|
||||
* - Edge Case: Non-ASCII (e.g., Unicode) data should be handled correctly.
|
||||
*/
|
||||
public void signAndVerifyNonAsciiMessage() throws Exception {
|
||||
// Use a message with Unicode characters.
|
||||
String nonAscii = "こんにちは世界"; // "Hello World" in Japanese.
|
||||
byte[] message = nonAscii.getBytes("UTF-8");
|
||||
KeyPair kp = generateEd25519KeyPair();
|
||||
byte[] sig = signEd25519(kp.getPrivate(), message);
|
||||
boolean verified = verifyEd25519(kp.getPublic(), message, sig);
|
||||
System.out.println("Non-ASCII message signature verified? " + verified);
|
||||
}
|
||||
|
||||
/**
|
||||
* Demonstrates that even a slight tampering with the signature will cause
|
||||
* verification to fail.
|
||||
|
||||
@@ -81,7 +81,7 @@ public class SymmetricAlgorithm {
|
||||
*/
|
||||
public byte[] aesGcmEncryptUnsafe(SecretKey key, byte[] plaintext) throws Exception {
|
||||
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
|
||||
byte[] iv = new byte[12]; // Fixed IV (all zeros by default) – insecure.
|
||||
byte[] iv = new byte[12]; // Fixed IV (all zeros by default) - insecure.
|
||||
GCMParameterSpec spec = new GCMParameterSpec(128, iv);
|
||||
cipher.init(Cipher.ENCRYPT_MODE, key, spec);
|
||||
byte[] ciphertext = cipher.doFinal(plaintext);
|
||||
|
||||
Reference in New Issue
Block a user