hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Crypto: Comment todo for observed missing modeled case. Tests for weak and unknown KDF iteration count.

Browse Source
This commit is contained in:
REDMOND\brodes
2025-10-16 14:07:45 -04:00
parent 3f36b09b3c
commit b9b0037e07
6 changed files with 94 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/lib/experimental/quantum/JCA.qll
View File

@@ -697,6 +697,8 @@ module JCAModel {
abstract DataFlow::Node getInputNode();
}
// TODO: for all parametert specs, I think they can be set through the constructor
// and through setter methods
class IvParameterSpecInstance extends NonceParameterInstantiation {
IvParameterSpecInstance() {
super.getConstructedType().hasQualifiedName("javax.crypto.spec", "IvParameterSpec")

63
java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownKDFIterationCount/Test.java Normal file
View File

@@ -0,0 +1,63 @@
import java.io.FileInputStream;
import java.io.IOException;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Arrays;
import java.util.Base64;
import java.util.Properties;
import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;
public class Test {
public static byte[] generateSalt(int length) {
SecureRandom random = new SecureRandom();
byte[] salt = new byte[length];
random.nextBytes(salt);
return salt;
}
/**
* PBKDF2 derivation with a very low iteration count.
*
* SAST/CBOM: - Parent: PBKDF2. - Iteration count is only 10, which is far
* below acceptable security standards. - Flagged as insecure.
*/
public void pbkdf2LowIteration(String password) throws Exception {
byte[] salt = generateSalt(16);
int iterationCount = 10; // $Source
PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, iterationCount, 256); // $Alert[java/quantum/weak-kdf-iteration-count]
SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
byte[] key = factory.generateSecret(spec).getEncoded();
}
/**
* PBKDF2 derivation with a very low iteration count.
*
* SAST/CBOM: - Parent: PBKDF2. - Iteration count is only 10, which is far
* below acceptable security standards. - Flagged as insecure.
*/
public void pbkdf2LowIteration(String password, int iterationCount) throws Exception { // $Source
byte[] salt = generateSalt(16);
PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, iterationCount, 256); // $Alert[java/quantum/unknown-kdf-iteration-count]
SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
byte[] key = factory.generateSecret(spec).getEncoded();
}
/**
* PBKDF2 derivation with a high iteration count.
*
* SAST/CBOM: - Parent: PBKDF2. - Uses 1,000,000 iterations; this is secure
* but may impact performance.
*/
public void pbkdf2HighIteration(String password) throws Exception {
byte[] salt = generateSalt(16);
int iterationCount = 1_000_000;
PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, iterationCount, 256);
SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
byte[] key = factory.generateSecret(spec).getEncoded();
}
}

5
java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownKDFIterationCount/UnknownKDFIterationCount.expected Normal file
View File

@@ -0,0 +1,5 @@
#select
| Test.java:47:22:47:49 | KeyDerivation | Key derivation operation with unknown iteration: $@ | Test.java:43:53:43:70 | iterationCount | iterationCount |
testFailures
| Test.java:45:94:45:145 | // $Alert[java/quantum/unknown-kdf-iteration-count] | Missing result: Alert[java/quantum/unknown-kdf-iteration-count] |
| Test.java:47:22:47:49 | Key derivation operation with unknown iteration: $@ | Unexpected result: Alert |

4
java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownKDFIterationCount/UnknownKDFIterationCount.qlref Normal file
View File

@@ -0,0 +1,4 @@
query: experimental/quantum/Examples/UnknownKDFIterationCount.ql
postprocess:
- utils/test/PrettyPrintModels.ql
- utils/test/InlineExpectationsTestQuery.ql

16
java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownKDFIterationCount/WeakKDFIterationCount.expected Normal file
View File

@@ -0,0 +1,16 @@
#select
| Test.java:32:72:32:85 | iterationCount | Test.java:31:30:31:31 | 10 : Number | Test.java:32:72:32:85 | iterationCount | Key derivation operation configures iteration count below 100k: $@ | Test.java:31:30:31:31 | 10 | 10 |
edges
| Test.java:31:30:31:31 | 10 : Number | Test.java:32:72:32:85 | iterationCount | provenance | |
| Test.java:43:53:43:70 | iterationCount : Number | Test.java:45:72:45:85 | iterationCount | provenance | |
| Test.java:58:30:58:38 | 1_000_000 : Number | Test.java:59:72:59:85 | iterationCount | provenance | |
nodes
| Test.java:31:30:31:31 | 10 : Number | semmle.label | 10 : Number |
| Test.java:32:72:32:85 | iterationCount | semmle.label | iterationCount |
| Test.java:43:53:43:70 | iterationCount : Number | semmle.label | iterationCount : Number |
| Test.java:45:72:45:85 | iterationCount | semmle.label | iterationCount |
| Test.java:58:30:58:38 | 1_000_000 : Number | semmle.label | 1_000_000 : Number |
| Test.java:59:72:59:85 | iterationCount | semmle.label | iterationCount |
subpaths
testFailures
| Test.java:43:92:43:102 | // $Source | Missing result: Source |

4
java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownKDFIterationCount/WeakKDFIterationCount.qlref Normal file
View File

@@ -0,0 +1,4 @@
query: experimental/quantum/Examples/WeakKDFIterationCount.ql
postprocess:
- utils/test/PrettyPrintModels.ql
- utils/test/InlineExpectationsTestQuery.ql