hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 16:25:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #15183 from egregius313/egregius313/java/fix-weak-hashing-adddition

Browse Source 
Java: Fix minor error in `java/potentially-weak-cryptographic-algorithm`
This commit is contained in:
Edward Minnix III
2023-12-22 11:38:55 -05:00
committed by GitHub
parent 9c039c4a08 be50696746
commit d6d76fa4f1
5 changed files with 46 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
View File

@@ -18,22 +18,10 @@ import semmle.code.java.frameworks.Properties
import semmle.code.java.security.MaybeBrokenCryptoAlgorithmQuery
import InsecureCryptoFlow::PathGraph
/**
* Get the string value represented by the given expression.
*
* If the value is a string literal, get the literal value.
* If the value is a call to `java.util.Properties::getProperty`, get the potential values of the property.
*/
string getStringValue(DataFlow::Node algo) {
result = algo.asExpr().(StringLiteral).getValue()
or
result = algo.asExpr().(PropertiesGetPropertyMethodCall).getPropertyValue()
}
from InsecureCryptoFlow::PathNode source, InsecureCryptoFlow::PathNode sink, CryptoAlgoSpec c
where
sink.getNode().asExpr() = c.getAlgoSpec() and
InsecureCryptoFlow::flowPath(source, sink)
select c, source, sink,
"Cryptographic algorithm $@ may not be secure, consider using a different algorithm.", source,
getStringValue(source.getNode())
source.getNode().asExpr().(InsecureAlgorithm).getStringValue()