hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Give reason why crypto algorithm is insecure

Browse Source
This commit is contained in:
Owen Mansel-Chan
2024-11-29 11:18:36 +00:00
parent bcb7901758
commit e6409e159f
8 changed files with 63 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/test/library-tests/Encryption/Test.java
View File

@@ -11,6 +11,10 @@ class Test {
"des_function",
"function_using_des",
"EncryptWithDES",
"RC2",
"RC4",
"ARCFOUR",
"RC5",
"AES/ECB/NoPadding",
"AES/CBC/PKCS5Padding");

4
java/ql/test/library-tests/Encryption/cryptoalgospec.expected
View File

@@ -1,2 +1,2 @@
| Test.java:37:4:37:17 | super(...) | Test.java:37:10:37:15 | "some" |
| Test.java:41:3:41:38 | getInstance(...) | Test.java:41:29:41:37 | "another" |
| Test.java:41:4:41:17 | super(...) | Test.java:41:10:41:15 | "some" |
| Test.java:45:3:45:38 | getInstance(...) | Test.java:45:29:45:37 | "another" |

18
java/ql/test/library-tests/Encryption/insecure.expected
View File

@@ -1,7 +1,11 @@
| Test.java:9:4:9:8 | "DES" |
| Test.java:10:4:10:8 | "des" |
| Test.java:11:4:11:17 | "des_function" |
| Test.java:12:4:12:23 | "function_using_des" |
| Test.java:13:4:13:19 | "EncryptWithDES" |
| Test.java:14:4:14:22 | "AES/ECB/NoPadding" |
| Test.java:15:4:15:25 | "AES/CBC/PKCS5Padding" |
| Test.java:9:4:9:8 | "DES" | It has a short key length of 56 bits, making it vulnerable to brute-force attacks. Consider using AES instead. |
| Test.java:10:4:10:8 | "des" | It has a short key length of 56 bits, making it vulnerable to brute-force attacks. Consider using AES instead. |
| Test.java:11:4:11:17 | "des_function" | It has a short key length of 56 bits, making it vulnerable to brute-force attacks. Consider using AES instead. |
| Test.java:12:4:12:23 | "function_using_des" | It has a short key length of 56 bits, making it vulnerable to brute-force attacks. Consider using AES instead. |
| Test.java:13:4:13:19 | "EncryptWithDES" | It has a short key length of 56 bits, making it vulnerable to brute-force attacks. Consider using AES instead. |
| Test.java:14:4:14:8 | "RC2" | It is vulnerable to related-key attacks. Consider using AES instead. |
| Test.java:15:4:15:8 | "RC4" | It has multiple vulnerabilities, including biases in its output and susceptibility to several attacks. Consider using AES instead. |
| Test.java:16:4:16:12 | "ARCFOUR" | It has multiple vulnerabilities, including biases in its output and susceptibility to several attacks. Consider using AES instead. |
| Test.java:17:4:17:8 | "RC5" | It is vulnerable to differential and related-key attacks. Consider using AES instead. |
| Test.java:18:4:18:22 | "AES/ECB/NoPadding" | Encryption mode ECB like AES/ECB/NoPadding is vulnerable to replay and other attacks. Consider using AES instead. |
| Test.java:19:4:19:25 | "AES/CBC/PKCS5Padding" | CBC mode of operation with PKCS#5 or PKCS#7 padding is vulnerable to padding oracle attacks. Consider using AES instead. |

10
java/ql/test/library-tests/Encryption/insecure.ql
View File

@@ -1,6 +1,10 @@
import default
import semmle.code.java.security.Encryption
from StringLiteral s
where s.getValue().regexpMatch(getInsecureAlgorithmRegex())
select s
from StringLiteral s, string reason
where
s.getValue().regexpMatch(getInsecureAlgorithmRegex()) and
if exists(getInsecureAlgorithmReason(s.getValue()))
then reason = getInsecureAlgorithmReason(s.getValue())
else reason = "<no reason>"
select s, reason

4
java/ql/test/library-tests/Encryption/secure.expected
View File

@@ -1,2 +1,2 @@
| Test.java:18:4:18:8 | "AES" |
| Test.java:19:4:19:17 | "AES_function" |
| Test.java:22:4:22:8 | "AES" |
| Test.java:23:4:23:17 | "AES_function" |

4
java/ql/test/query-tests/security/CWE-327/semmle/tests/BrokenCryptoAlgorithm.expected
View File

@@ -1,6 +1,6 @@
#select
| Test.java:19:20:19:50 | getInstance(...) | Test.java:19:45:19:49 | "DES" | Test.java:19:45:19:49 | "DES" | Cryptographic algorithm $@ is weak and should not be used. | Test.java:19:45:19:49 | "DES" | DES |
| Test.java:42:14:42:38 | getInstance(...) | Test.java:42:33:42:37 | "RC2" | Test.java:42:33:42:37 | "RC2" | Cryptographic algorithm $@ is weak and should not be used. | Test.java:42:33:42:37 | "RC2" | RC2 |
| Test.java:19:20:19:50 | getInstance(...) | Test.java:19:45:19:49 | "DES" | Test.java:19:45:19:49 | "DES" | Cryptographic algorithm $@ is insecure. It has a short key length of 56 bits, making it vulnerable to brute-force attacks. Consider using AES instead. | Test.java:19:45:19:49 | "DES" | DES |
| Test.java:42:14:42:38 | getInstance(...) | Test.java:42:33:42:37 | "RC2" | Test.java:42:33:42:37 | "RC2" | Cryptographic algorithm $@ is insecure. It is vulnerable to related-key attacks. Consider using AES instead. | Test.java:42:33:42:37 | "RC2" | RC2 |
edges
nodes
| Test.java:19:45:19:49 | "DES" | semmle.label | "DES" |