hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reiview suggestions - add doc comment, reword description, simplify a part

Browse Source
This commit is contained in:
Joe Farebrother
2022-07-19 14:50:12 +01:00
parent a62bb8e115
commit bf32b5a8fd
2 changed files with 5 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
java/ql/lib/semmle/code/java/security/StaticInitializationVectorQuery.qll
View File

@@ -1,3 +1,5 @@
/** Definitions for the Static Initialization Vector query. */
import java
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.dataflow.TaintTracking2
@@ -73,9 +75,7 @@ private class ArrayUpdateConfig extends TaintTracking2::Configuration {
source.asExpr() instanceof StaticByteArrayCreation
}
override predicate isSink(DataFlow::Node sink) {
exists(ArrayUpdate update | update.getArray() = sink.asExpr())
}
override predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(ArrayUpdate upd).getArray() }
}
/**

9
java/ql/src/Security/CWE/CWE-1204/StaticInitializationVector.ql
View File

@@ -1,12 +1,7 @@
/**
* @name Using a static initialization vector for encryption
* @description A cipher needs an initialization vector (IV) in some cases,
* for example, when CBC or GCM modes are used. IVs are used to randomize the encryption,
* therefore they should be unique and ideally unpredictable.
* Otherwise, the same plaintexts result in same ciphertexts under a given secret key.
* If a static IV is used for encryption, this lets an attacker learn
* if the same data pieces are transferred or stored,
* or this can help the attacker run a dictionary attack.
* @description An initialization vector (IV) used for ciphers of certain modes (such as CBC or GCM) should be unique and unpredicateble.
* Otherwise, if the same IV is used with a the same secret key then the same plaintext results in same ciphertext, which weakens the encryption.
* @kind path-problem
* @problem.severity warning
* @precision high