1208 Commits

Author	SHA1	Message	Date
REDMOND\brodes	dd60cf9395	Crypto: Adjust output of bad mac order queries, update associated bad mac order expected results, fix erroneous change to ID for a slicing query, update model to specify elliptic curve type as a property, update associated graph test expected files, update the not_included_in_qls.expected to reflect all queries now under quantum.	2025-10-22 10:29:31 -04:00
REDMOND\brodes	c50175bc9b	Crypto: ql-for-ql alert fixes.	2025-10-21 10:32:00 -04:00
REDMOND\brodes	22c0f9fa91	Crypto: Adding a proof of concept bad mac ordering predicate that takes in an ArtifactNode to be used for graph generation to intercept nodes with known mac ordering issues, in order to format the node and output error messages in the graph.	2025-10-20 16:24:31 -04:00
REDMOND\brodes	eff94ef91f	Crypto: To allow for graph generation to have properties informed by assessments, altering a few queries weak/vuln/bad crypto to have qll files that can be accessed for other purposes, like graph generation. Also altering weak symmetric cipher to look for non-aes algorithms to be more comprehensive.	2025-10-20 15:51:07 -04:00
Ben Rodes	2b683c210f	Merge branch 'main' into santander-java-crypto-check	2025-10-18 17:56:43 -04:00
REDMOND\brodes	c01c060476	Crypto: more ID renaming to include "examples", fix singleton issues with ql-for-ql, use formatted test for WeakAsymmetricKeyGenSize (add post processing in the qlref), misc expected files updated (test passed locally but on rerun vscode reports failures, known bug with vscode unit tests).	2025-10-17 14:13:53 -04:00
REDMOND\brodes	b06e05362b	Crypto: altering all query IDs in examples to have "examples" in the ID, to make clear the query is not intended for production.	2025-10-17 13:39:50 -04:00
REDMOND\brodes	1b205d8673	Removing WeakRSA, this is redundant with weak asymmetric key size.	2025-10-17 13:39:05 -04:00
REDMOND\brodes	628bab92fc	Crypto: Modify BadMacOrderMacOnEncryptPlaintext to be a path query that traces through any intermediate encrypt or mac to the final encrypt or mac.	2025-10-17 12:06:34 -04:00
REDMOND\brodes	ff7840dc9f	Crypto: removing precision tags on experimental queries.	2025-10-17 10:52:32 -04:00
REDMOND\brodes	ef6f0222f2	Crypto: Addressing FPs in BadMacOrderMacOnEncryptPlaintext	2025-10-16 16:11:42 -04:00
REDMOND\brodes	700f34e53a	Crypto: Bad Mac use tests, and fix for BadMacOrderMacOnEncryptPlaintext (barriers were blocking flow through an encrypt to a subsequent mac on the same plaintext)	2025-10-16 15:44:57 -04:00
REDMOND\brodes	79ccef3a58	Crypto: Initial sketch for unknown hash, the model needs to recognize unknowns but where the algorithm category (e.g., hashing) is known.	2025-10-16 11:03:16 -04:00
REDMOND\brodes	15e266db94	Crypto: Tweaks to bad crypto ordering queries.	2025-10-15 14:20:40 -04:00
REDMOND\brodes	c6174fbb93	Crypto: remove precision tag	2025-10-15 14:10:16 -04:00
REDMOND\brodes	c7be23e1fe	Crypto: Remove all precision tags from all experimental queries. Precision is largely in flux while the models are being developed.	2025-10-15 09:22:04 -04:00
REDMOND\brodes	bf9a249624	Crypto: Experimental queries for mac ordering	2025-10-15 08:06:50 -04:00
REDMOND\brodes	55bbcee301	Crypto: Make WeakAsymmetricKeyGenSize a path problem.	2025-10-13 17:04:29 -04:00
REDMOND\brodes	7e8acd76c3	Crypto: Update WeakAsymmetricKeyGenSize to a path problem.	2025-10-13 15:48:32 -04:00
REDMOND\brodes	8b5a42328e	Crypto: Convert ReusedNonce.ql into a path problem.	2025-10-13 15:34:41 -04:00
REDMOND\brodes	7847e92670	Crypto: Update KDF iteration and count to be path problems	2025-10-13 15:30:53 -04:00
REDMOND\brodes	76128ed8dc	Crypto: Update InsecureIVorNonce to be a path problem.	2025-10-13 15:29:57 -04:00
REDMOND\brodes	4b241d7065	Crypto: adding initial weak hash query overhaul and tests, but no expected file yet.	2025-10-13 12:04:51 -04:00
Joe Farebrother	c4781146c0	Remove experimental query and tests	2025-10-13 14:51:10 +01:00
REDMOND\brodes	e76ced1513	Crypto: Updating weak asymmetric key gen to include key exchange.	2025-10-10 15:32:39 -04:00
REDMOND\brodes	d68f3cff8b	Crypto: InsecureIVorNonceSource now ignored null to avoid being too noisy.	2025-10-10 14:51:16 -04:00
REDMOND\brodes	36673659ad	Crypto: Weak asymmetric key gen size fixes and test.	2025-10-10 14:49:35 -04:00
REDMOND\brodes	758759a304	Crypto: Reused nonce query updates and test updates to address false positives.	2025-10-10 12:25:31 -04:00
REDMOND\brodes	fba80870a6	Crypto: Example query reorg - moving queries of this PR into 'examples' subdirectories.	2025-10-09 09:03:00 -04:00
REDMOND\brodes	deb43735be	Crypto: Minor fixes to WeakSymmetricCipher, change to a singular name for consistency.	2025-10-09 08:39:39 -04:00
REDMOND\brodes	3dedda4233	Merge branch 'santander-java-crypto-check' of https://github.com/bdrodes/codeql into santander-java-crypto-check	2025-10-09 08:18:04 -04:00
REDMOND\brodes	c6cc4fff51	Crypto: Minor fixes to WeakBlockModes, WeakHash to consider SHA3 ok, Added unknown hash.	2025-10-09 08:16:28 -04:00
Nicolas Will	fdba3acc4b	Crypto: Fix QL-for-QL alert and auto-format	2025-10-09 13:59:51 +02:00
REDMOND\brodes	f524de4afc	Crypto: Updating insecure iv/nonce to consider if an operation is known for it, and if so do not alert on non-secure random if it is tied to decryption	2025-10-08 16:27:18 -04:00
REDMOND\brodes	11e81395b5	Crypto: Updated default flows to use taint tracking (this is needed to fix false positives in the unknown IV/Nonce query). Add the unknown IV/Nonce query and associated test cases. Fix unknown IV/Nonce query to focus on cases where the oepration isn't known or the operation subtype is not encrypt or wrap.	2025-10-08 14:14:17 -04:00
REDMOND\brodes	8e10e1937d	Crypto: Adding query for unknown IV initialization.	2025-10-08 12:49:54 -04:00
REDMOND\brodes	83ff70bcd8	Crypto: Adding tests for insecure iv or nonce. Updating generic literal sources to include array literals.	2025-10-08 12:47:58 -04:00
REDMOND\brodes	bd34b6ce02	Crypto: Removing JCA model of random, need to reassess this as this impacts the insecure IV/Nonce query. Updated name of the Insecure nonce query to be InsecureIVorNonce	2025-10-08 11:41:21 -04:00
REDMOND\brodes	143be8cc35	Crypto: Remove redundant queries.	2025-10-08 10:26:05 -04:00
REDMOND\brodes	1b1b333e8b	Crypto: Modify suggested queries per misc. side conversations on standards. Remove redundant query. Fix QL-for-QL issues.	2025-10-08 10:21:06 -04:00
Mark C	f38ab45e94	removed all @security.severity ratings to keep the main impartial	2025-10-01 17:49:45 +01:00
Mark C	c5cf0ffa75	added java cryptographic check queries	2025-10-01 11:55:51 +01:00
Michael Nebel	a732b36fa8	Update java/ql/src/experimental/quantum/Analysis/ArtifactReuse.qll ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2025-09-02 10:39:37 +02:00
Michael Nebel	77113b2e42	Java: Fix some Ql4Ql violations.	2025-09-01 15:04:08 +02:00
Jami Cogswell	0dbddbdf0f	Java: remove experimental files	2025-07-17 19:22:03 -04:00
Kasper Svendsen	e6ef6a3326	Merge branch 'main' into kaspersv/overlay-java-discarding	2025-06-27 08:28:34 +02:00
Nicolas Will	98479ff6c3	Crypto: Update queries to use new type names	2025-06-25 20:34:33 +02:00
Kasper Svendsen	b6e56f26c7	Java: Add manual overlay annotations	2025-06-24 10:38:05 +02:00
Nicolas Will	c66ec63333	Fix query compilation errors	2025-05-12 14:48:58 +02:00
Nicolas Will	8f36624171	Add AsymmetricAlgorithmNode, refactor and address feedback	2025-05-12 14:37:44 +02:00