Merge pull request #9982 from joefarebrother/rsa-without-oaep

Java: Add query for RSA without OAEP

java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.java

@@ -0,0 +1,17 @@
+import javax.crypto.Cipher;
+
+class RsaWithoutOaep {
+    public void test() throws Exception {
+        Cipher rsaBad = Cipher.getInstance("RSA/ECB/NoPadding"); // $hasTaintFlow
+
+        Cipher rsaGood = Cipher.getInstance("RSA/ECB/OAEPWithSHA-1AndMGF1Padding"); 
+    }
+
+    public Cipher getCipher(String spec) throws Exception {
+        return Cipher.getInstance(spec); // $hasTaintFlow
+    }
+
+    public void test2() throws Exception {
+        Cipher rsa = getCipher("RSA/ECB/NoPadding");
+    }
+}

java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.ql

@@ -0,0 +1,10 @@
+import java
+import TestUtilities.InlineExpectationsTest
+import TestUtilities.InlineFlowTest
+import semmle.code.java.security.RsaWithoutOaepQuery
+
+class HasFlowTest extends InlineFlowTest {
+  override DataFlow::Configuration getTaintFlowConfig() { result instanceof RsaWithoutOaepConfig }
+
+  override DataFlow::Configuration getValueFlowConfig() { none() }
+}