hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-21 23:14:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Rust: Model for cipher traits.

Browse Source
This commit is contained in:
Geoffrey White
2024-12-05 12:32:25 +00:00
parent eeeb142f0b
commit 94dbad7c95
4 changed files with 62 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
rust/ql/lib/codeql/rust/Frameworks.qll
View File

@@ -3,5 +3,6 @@
*/
private import codeql.rust.frameworks.Reqwest
private import codeql.rust.frameworks.RustCrypto
private import codeql.rust.frameworks.stdlib.Env
private import codeql.rust.frameworks.Sqlx

35
rust/ql/lib/codeql/rust/frameworks/RustCrypto.qll Normal file
View File

@@ -0,0 +1,35 @@
/**
* Provides modeling for the `RustCrypto` family of crates (`cipher`, `digest` etc).
*/
private import rust
private import codeql.rust.Concepts
private import codeql.rust.dataflow.DataFlow
/**
* An operation that initializes a cipher through the `cipher::KeyInit` or
* `cipher::KeyIvInit` trait, for example `Des::new` or `cbc::Encryptor<des::Des>::new`.
*/
class StreamCipherInit extends Cryptography::CryptographicOperation::Range, DataFlow::Node {
string algorithmName;
StreamCipherInit() {
// a call to `cipher::KeyInit::new`, `cipher::KeyInit::new_from_slice`,
// `cipher::KeyIvInit::new` or `cipher::KeyIvInit::new_from_slices`.
exists(Path p |
this.asExpr().getExpr().(CallExpr).getFunction().(PathExpr).getPath() = p and
p.getResolvedCrateOrigin().matches("%/RustCrypto%") and
p.getPart().getNameRef().getText() =
["new", "new_from_slice", "new_from_slices"] and
algorithmName = p.getQualifier().getPart().getNameRef().getText()
)
}
override DataFlow::Node getInitialization() { result = this }
override Cryptography::CryptographicAlgorithm getAlgorithm() { result.matchesName(algorithmName) }
override DataFlow::Node getAnInput() { none() }
override Cryptography::BlockMode getBlockMode() { result = "" }
}

13
rust/ql/test/query-tests/security/CWE-327/BrokenCryptoAlgorithm.expected
View File

@@ -0,0 +1,13 @@
| test_cipher.rs:20:27:20:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:20:27:20:48 | ...::new(...) | The cryptographic algorithm RC4 |
| test_cipher.rs:23:27:23:60 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:23:27:23:60 | ...::new_from_slice(...) | The cryptographic algorithm RC4 |
| test_cipher.rs:26:27:26:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:26:27:26:48 | ...::new(...) | The cryptographic algorithm RC4 |
| test_cipher.rs:29:27:29:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:29:27:29:48 | ...::new(...) | The cryptographic algorithm RC4 |
| test_cipher.rs:59:23:59:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:59:23:59:42 | ...::new(...) | The cryptographic algorithm DES |
| test_cipher.rs:63:23:63:47 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:63:23:63:47 | ...::new(...) | The cryptographic algorithm DES |
| test_cipher.rs:67:23:67:46 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:67:23:67:46 | ...::new_from_slice(...) | The cryptographic algorithm DES |
| test_cipher.rs:71:23:71:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:71:23:71:42 | ...::new(...) | The cryptographic algorithm DES |
| test_cipher.rs:75:27:75:46 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:75:27:75:46 | ...::new(...) | The cryptographic algorithm DES |
| test_cipher.rs:97:23:97:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:97:23:97:42 | ...::new(...) | The cryptographic algorithm RC2 |
| test_cipher.rs:101:23:101:46 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:101:23:101:46 | ...::new_from_slice(...) | The cryptographic algorithm RC2 |
| test_cipher.rs:110:23:110:50 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:110:23:110:50 | ...::new(...) | The cryptographic algorithm RC5 |
| test_cipher.rs:114:23:114:55 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:114:23:114:55 | ...::new_from_slice(...) | The cryptographic algorithm RC5 |

26
rust/ql/test/query-tests/security/CWE-327/test_cipher.rs
View File

@@ -17,16 +17,16 @@ fn test_stream_cipher(
// rc4 (broken)
let rc4_key = rc4::Key::<U16>::from_slice(key128);
let mut rc4_cipher1 = Rc4::<_>::new(rc4_key); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let mut rc4_cipher1 = Rc4::<_>::new(rc4_key); // $ Alert[rust/weak-cryptographic-algorithm]
rc4_cipher1.apply_keystream(&mut data);
let mut rc4_cipher2 = Rc4::<U16>::new_from_slice(key128).unwrap(); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let mut rc4_cipher2 = Rc4::<U16>::new_from_slice(key128).unwrap(); // $ Alert[rust/weak-cryptographic-algorithm]
rc4_cipher2.apply_keystream(&mut data);
let mut rc4_cipher3 = Rc4::<_>::new(rc4_key); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let mut rc4_cipher3 = Rc4::<_>::new(rc4_key); // $ Alert[rust/weak-cryptographic-algorithm]
let _ = rc4_cipher3.try_apply_keystream(&mut data);
let mut rc4_cipher4 = Rc4::<_>::new(rc4_key); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let mut rc4_cipher4 = Rc4::<_>::new(rc4_key); // $ Alert[rust/weak-cryptographic-algorithm]
let _ = rc4_cipher4.apply_keystream_b2b(plaintext.as_bytes(), &mut data);
// rabbit
@@ -56,23 +56,23 @@ fn test_block_cipher(
aes_cipher3.decrypt_block(block128.into());
// des (broken)
let des_cipher1 = Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let des_cipher1 = Des::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
des_cipher1.encrypt_block(data.into());
des_cipher1.decrypt_block(data.into());
let des_cipher2 = des::Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let des_cipher2 = des::Des::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
des_cipher2.encrypt_block(data.into());
des_cipher2.decrypt_block(data.into());
let des_cipher3 = Des::new_from_slice(key).expect("fail"); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let des_cipher3 = Des::new_from_slice(key).expect("fail"); // $ Alert[rust/weak-cryptographic-algorithm]
des_cipher3.encrypt_block(data.into());
des_cipher3.decrypt_block(data.into());
let des_cipher4 = Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let des_cipher4 = Des::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
des_cipher4.encrypt_block_b2b(input.into(), data.into());
des_cipher4.decrypt_block_b2b(input.into(), data.into());
let mut des_cipher5 = Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let mut des_cipher5 = Des::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
des_cipher5.encrypt_block_mut(data.into());
des_cipher5.decrypt_block_mut(data.into());
@@ -94,11 +94,11 @@ fn test_block_cipher(
tdes_cipher4.decrypt_block(data.into());
// rc2 (broken)
let rc2_cipher1 = Rc2::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let rc2_cipher1 = Rc2::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
rc2_cipher1.encrypt_block(data.into());
rc2_cipher1.decrypt_block(data.into());
let rc2_cipher2 = Rc2::new_from_slice(key).expect("fail"); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let rc2_cipher2 = Rc2::new_from_slice(key).expect("fail"); // $ Alert[rust/weak-cryptographic-algorithm]
rc2_cipher2.encrypt_block(data.into());
rc2_cipher2.decrypt_block(data.into());
@@ -107,11 +107,11 @@ fn test_block_cipher(
rc2_cipher3.decrypt_block(data.into());
// rc5 (broken)
let rc5_cipher1 = RC5_16_16_8::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let rc5_cipher1 = RC5_16_16_8::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
rc5_cipher1.encrypt_block(data.into());
rc5_cipher1.decrypt_block(data.into());
let rc5_cipher2 = RC5_32_16_16::new_from_slice(key).unwrap(); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
let rc5_cipher2 = RC5_32_16_16::new_from_slice(key).unwrap(); // $ Alert[rust/weak-cryptographic-algorithm]
rc5_cipher2.encrypt_block(data.into());
rc5_cipher2.decrypt_block(data.into());
}