hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix typo and update qldoc

Browse Source
This commit is contained in:
luchua-bc
2020-12-16 14:04:45 +00:00
parent d7facb42d6
commit 6b77922a25
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp
View File

@@ -12,7 +12,7 @@ data.</p>
</overview>
<recommendation>
<p>Ensure that you use a strong, modern cryptographic algorithm. Use at least AES-128 or RSA-2048. Do not use the ECB encryption mode since it is vulnerable to reply attacks.</p>
<p>Ensure that you use a strong, modern cryptographic algorithm. Use at least AES-128 or RSA-2048. Do not use the ECB encryption mode since it is vulnerable to replay and other attacks.</p>
</recommendation>
<example>

2
java/ql/src/semmle/code/java/security/Encryption.qll
View File

@@ -98,7 +98,7 @@ string getAnInsecureAlgorithmName() {
result = "RC4" or
result = "RC5" or
result = "ARCFOUR" or // a variant of RC4
result = "ECB" or // encryption mode ECB like AES/ECB/NoPadding is vulnerable to replay attacks
result = "ECB" or // encryption mode ECB like AES/ECB/NoPadding is vulnerable to replay and other attacks
result = "AES/CBC/PKCS5Padding" // CBC mode of operation with PKCS#5 (or PKCS#7) padding is vulnerable to padding oracle attacks
}