Use CryptoAlgoSpec rather than hadcoding Cipher.getInstance

java/ql/lib/semmle/code/java/security/RsaWithoutOaepQuery.qll

@@ -1,14 +1,14 @@
 /** Definitions for the RSE without OAEP query */
 
 import java
+import Encryption
 import semmle.code.java.dataflow.DataFlow
 
-/** Holds if `ma` is a call to `Cipher.getInstance` which initialises an RSA cipher without using OAEP padding. */
-predicate rsaWithoutOaepCall(MethodAccess ma) {
-  ma.getMethod().hasQualifiedName("javax.crypto", "Cipher", "getInstance") and
+/** Holds if `c` is a call which initialises an RSA cipher without using OAEP padding. */
+predicate rsaWithoutOaepCall(CryptoAlgoSpec c) {
   exists(CompileTimeConstantExpr specExpr, string spec |
     specExpr.getStringValue() = spec and
-    DataFlow::localExprFlow(specExpr, ma.getArgument(0)) and
+    DataFlow::localExprFlow(specExpr, c.getAlgoSpec()) and
     spec.matches("RSA/%") and
     not spec.matches("%OAEP%")
   )

java/ql/src/Security/CWE/CWE-780/RsaWithoutOaep.ql

@@ -11,8 +11,9 @@
  */
 
 import java
+import semmle.code.java.security.Encryption
 import semmle.code.java.security.RsaWithoutOaepQuery
 
-from MethodAccess ma
-where rsaWithoutOaepCall(ma)
-select ma, "This instance of RSA does not use OAEP padding."
+from CryptoAlgoSpec c
+where rsaWithoutOaepCall(c)
+select c, "This instance of RSA does not use OAEP padding."

java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.ql

@@ -10,10 +10,10 @@ class HasResult extends InlineExpectationsTest {
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     tag = "hasResult" and
     value = "" and
-    exists(MethodAccess ma |
-      rsaWithoutOaepCall(ma) and
-      location = ma.getLocation() and
-      element = ma.toString()
+    exists(CryptoAlgoSpec c |
+      rsaWithoutOaepCall(c) and
+      location = c.getLocation() and
+      element = c.toString()
     )
   }
 }