From a9449cc99183003883f6ec6375974d4382aecbff Mon Sep 17 00:00:00 2001 From: MarkLee131 Date: Fri, 27 Mar 2026 19:08:27 +0800 Subject: [PATCH] Add EC to secure algorithm whitelist for Java CWE-327 query --- .../2026-03-27-add-ec-to-secure-algorithms.md | 4 +++ .../semmle/code/java/security/Encryption.qll | 6 +++- .../security/CWE-327/semmle/tests/Test.java | 33 +++++++++++++++++++ 3 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md diff --git a/java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md b/java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md new file mode 100644 index 00000000000..2c46d38ebfe --- /dev/null +++ b/java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The `java/potentially-weak-cryptographic-algorithm` query no longer flags Elliptic Curve algorithms (`EC`, `ECDSA`, `ECDH`, `EdDSA`, `Ed25519`, `Ed448`, `XDH`, `X25519`, `X448`) as potentially insecure. These are modern, secure algorithms recommended by NIST SP 800-57 and other standards bodies. Previously, these algorithms were not included in the secure algorithm whitelist, causing false positives when using standard Java cryptographic APIs such as `KeyPairGenerator.getInstance("EC")`. diff --git a/java/ql/lib/semmle/code/java/security/Encryption.qll b/java/ql/lib/semmle/code/java/security/Encryption.qll index b0a0fc72df7..afbace5bf45 100644 --- a/java/ql/lib/semmle/code/java/security/Encryption.qll +++ b/java/ql/lib/semmle/code/java/security/Encryption.qll @@ -259,7 +259,11 @@ string getASecureAlgorithmName() { result = [ "RSA", "SHA-?(256|384|512)", "CCM", "GCM", "AES(?![^a-zA-Z](ECB|CBC/PKCS[57]Padding))", - "Blowfish", "ECIES", "SHA3-(256|384|512)" + "Blowfish", "ECIES", "SHA3-(256|384|512)", + // Elliptic Curve algorithms: EC (key generation), ECDSA (signatures), ECDH (key agreement), + // EdDSA/Ed25519/Ed448 (Edwards-curve signatures), XDH/X25519/X448 (key agreement). + // These are modern, secure algorithms recommended by NIST and other standards bodies. + "EC", "ECDSA", "ECDH", "EdDSA", "Ed25519", "Ed448", "XDH", "X25519", "X448" ] } diff --git a/java/ql/test/query-tests/security/CWE-327/semmle/tests/Test.java b/java/ql/test/query-tests/security/CWE-327/semmle/tests/Test.java index 2f66d499639..41ce1e69784 100644 --- a/java/ql/test/query-tests/security/CWE-327/semmle/tests/Test.java +++ b/java/ql/test/query-tests/security/CWE-327/semmle/tests/Test.java @@ -46,6 +46,39 @@ class Test { cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec); byte[] encrypted = cipher.doFinal(input.getBytes("UTF-8")); + + KeyPairGenerator keyPairGenerator; + + // GOOD: EC is a secure algorithm for key pair generation + keyPairGenerator = KeyPairGenerator.getInstance("EC"); + + // GOOD: ECDSA is a secure algorithm for digital signatures + Signature ecdsaSig = Signature.getInstance("ECDSA"); + + // GOOD: ECDH is a secure algorithm for key agreement + KeyAgreement ecdhKa = KeyAgreement.getInstance("ECDH"); + + // GOOD: EdDSA is a secure algorithm (Edwards-curve Digital Signature Algorithm) + keyPairGenerator = KeyPairGenerator.getInstance("EdDSA"); + + // GOOD: Ed25519 is a secure algorithm + keyPairGenerator = KeyPairGenerator.getInstance("Ed25519"); + + // GOOD: Ed448 is a secure algorithm + keyPairGenerator = KeyPairGenerator.getInstance("Ed448"); + + // GOOD: XDH is a secure algorithm for key agreement + keyPairGenerator = KeyPairGenerator.getInstance("XDH"); + + // GOOD: X25519 is a secure algorithm for key agreement + keyPairGenerator = KeyPairGenerator.getInstance("X25519"); + + // GOOD: X448 is a secure algorithm for key agreement + keyPairGenerator = KeyPairGenerator.getInstance("X448"); + + // GOOD: SHA256withECDSA is a secure signature algorithm + Signature sha256Ecdsa = Signature.getInstance("SHA256withECDSA"); + } catch (Exception e) { // fail }