mirror of
https://github.com/github/codeql.git
synced 2026-06-05 21:47:10 +02:00
Compare commits
2 Commits
codeql-cli
...
turbo/expe
| Author | SHA1 | Date | |
|---|---|---|---|
|
118daaba5c | ||
|
|
ce2b59ae4a |
@@ -9,6 +9,7 @@
|
||||
* @tags reliability
|
||||
* security
|
||||
* external/cwe/cwe-476
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-20
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -12,6 +12,7 @@
|
||||
* @security-severity 7.5
|
||||
* @tags security
|
||||
* external/cwe/cwe-020
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* maintainability
|
||||
* security
|
||||
* external/cwe/cwe-1041
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-1126
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @tags reliability
|
||||
* security
|
||||
* external/cwe/cwe-120
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-125
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* correctness
|
||||
* external/cwe/cwe-190
|
||||
* external/cwe/cwe-128
|
||||
* experimental
|
||||
* @id cpp/multiplication-overflow-in-alloc
|
||||
*/
|
||||
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-190
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* security
|
||||
* external/cwe/cwe-200
|
||||
* external/cwe/cwe-264
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* security
|
||||
* external/cwe/cwe-243
|
||||
* external/cwe/cwe-252
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -13,6 +13,7 @@
|
||||
* external/cwe/cwe-200
|
||||
* external/cwe/cwe-560
|
||||
* external/cwe/cwe-687
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @id cpp/drop-linux-privileges-outoforder
|
||||
* @tags security
|
||||
* external/cwe/cwe-273
|
||||
* experimental
|
||||
* @precision medium
|
||||
*/
|
||||
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
* @id cpp/pam-auth-bypass
|
||||
* @tags security
|
||||
* external/cwe/cwe-285
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id cpp/private-cleartext-write
|
||||
* @tags security
|
||||
* external/cwe/cwe-359
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -12,6 +12,7 @@
|
||||
* @security-severity 7.5
|
||||
* @tags security
|
||||
* external/cwe/cwe-362
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-377
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-401
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @precision medium
|
||||
* @tags security
|
||||
* external/cwe/cwe-415
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* security
|
||||
* external/cwe/cwe-476
|
||||
* external/cwe/cwe-415
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -11,6 +11,7 @@
|
||||
* external/cwe/cwe-561
|
||||
* external/cwe/cwe-691
|
||||
* external/cwe/cwe-478
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-670
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @tags security
|
||||
* external/cwe/cwe-675
|
||||
* external/cwe/cwe-666
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -11,6 +11,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-691
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-691
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* external/cwe/cwe-703
|
||||
* external/cwe/cwe-248
|
||||
* external/cwe/cwe-390
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* security
|
||||
* external/cwe/cwe-754
|
||||
* external/cwe/cwe-908
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @precision medium
|
||||
* @tags security
|
||||
* external/cwe/cwe-758
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* readability
|
||||
* external/cwe/cwe-783
|
||||
* external/cwe/cwe-480
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* security
|
||||
* external/cwe/cwe-783
|
||||
* external/cwe/cwe-480
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @tags reliability
|
||||
* security
|
||||
* external/cwe/cwe-787
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-788
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import cpp
|
||||
|
||||
@@ -11,6 +11,7 @@
|
||||
* external/cwe/cwe-023
|
||||
* external/cwe/cwe-036
|
||||
* external/cwe/cwe-073
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id cs/request-forgery
|
||||
* @tags security
|
||||
* external/cwe/cwe-918
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* @id cs/web/cookie-httponly-not-set
|
||||
* @tags security
|
||||
* external/cwe/cwe-1004
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -5,6 +5,7 @@
|
||||
* @tags security
|
||||
* cryptography
|
||||
* external/cwe/cwe-327
|
||||
* experimental
|
||||
* @id cs/azure-storage/unsafe-usage-of-client-side-encryption-version
|
||||
* @problem.severity error
|
||||
* @precision high
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* @tags security
|
||||
* external/cwe/cwe-319
|
||||
* external/cwe/cwe-614
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
* @id cs/hash-without-salt
|
||||
* @tags security
|
||||
* external/cwe-759
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -5,6 +5,7 @@
|
||||
* @problem.severity warning
|
||||
* @id cs/dataset-serialization/defining-dataset-related-type
|
||||
* @tags security
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
* @precision medium
|
||||
* @id cs/dataset-serialization/defining-potentially-unsafe-xml-serializer
|
||||
* @tags security
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
* @precision medium
|
||||
* @id cs/dataset-serialization/unsafe-type-used-data-contract-serializer
|
||||
* @tags security
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
* @precision medium
|
||||
* @id cs/dataset-serialization/xml-deserialization-with-dataset
|
||||
* @tags security
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id cs/backdoor/dangerous-native-functions
|
||||
* @tags security
|
||||
* solorigate
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id cs/backdoor/potential-time-bomb
|
||||
* @tags security
|
||||
* solorigate
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import csharp
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
* @kind path-problem
|
||||
* @tags security
|
||||
* solorigate
|
||||
* experimental
|
||||
* @problem.severity warning
|
||||
* @precision medium
|
||||
* @id cs/backdoor/process-name-to-hash-function
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id go/ldap-injection
|
||||
* @tags security
|
||||
* external/cwe/cwe-90
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* @id go/cookie-httponly-not-set
|
||||
* @tags security
|
||||
* external/cwe/cwe-1004
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* correctness
|
||||
* external/cwe/cwe-561
|
||||
* external/cwe/cwe-285
|
||||
* experimental
|
||||
* @precision very-high
|
||||
*/
|
||||
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
* @id go/hardcoded-key
|
||||
* @tags security
|
||||
* external/cwe/cwe-321
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -5,8 +5,9 @@
|
||||
* @problem.severity error
|
||||
* @id go/weak-crypto-algorithm
|
||||
* @tags security
|
||||
* external/cwe/cwe-327
|
||||
* external/cwe/cwe-328
|
||||
* external/cwe/cwe-327
|
||||
* external/cwe/cwe-328
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
* @id go/divide-by-zero
|
||||
* @tags security
|
||||
* external/cwe/cwe-369
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -6,6 +6,9 @@
|
||||
* @problem.severity warning
|
||||
* @precision high
|
||||
* @id go/examples/database-call-in-loop
|
||||
* @tags security
|
||||
* external/cwe/cwe-400
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id go/html-template-escaping-passthrough
|
||||
* @tags security
|
||||
* external/cwe/cwe-79
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -8,6 +8,8 @@
|
||||
* @tags external/cwe/cwe-807
|
||||
* external/cwe/cwe-247
|
||||
* external/cwe/cwe-350
|
||||
* security
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -6,6 +6,8 @@
|
||||
* @kind problem
|
||||
* @problem.severity warning
|
||||
* @tags external/cwe/cwe-840
|
||||
* experimental
|
||||
* security
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
* @problem.severity error
|
||||
* @precision high
|
||||
* @tags security
|
||||
* experimental
|
||||
* external/cwe/cwe-918
|
||||
*/
|
||||
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @tags security
|
||||
* external/cwe/cwe-942
|
||||
* external/cwe/cwe-346
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @tags security
|
||||
* external/cwe/cwe-119
|
||||
* external/cwe/cwe-126
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/insecure-spring-actuator-config
|
||||
* @tags security
|
||||
* external/cwe/cwe-016
|
||||
* experimental
|
||||
*/
|
||||
|
||||
/*
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/spring-boot-exposed-actuators
|
||||
* @tags security
|
||||
* external/cwe/cwe-16
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -12,6 +12,7 @@
|
||||
* external/cwe/cwe-074
|
||||
* external/cwe/cwe-400
|
||||
* external/cwe/cwe-502
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/openstream-called-on-tainted-url
|
||||
* @tags security
|
||||
* external/cwe/cwe-036
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @id java/file-path-injection
|
||||
* @tags security
|
||||
* external/cwe-073
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @tags security
|
||||
* external/cwe/cwe-078
|
||||
* external/cwe/cwe-088
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @id java/mybatis-annotation-sql-injection
|
||||
* @tags security
|
||||
* external/cwe/cwe-089
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @id java/mybatis-xml-sql-injection
|
||||
* @tags security
|
||||
* external/cwe/cwe-089
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/beanshell-injection
|
||||
* @tags security
|
||||
* external/cwe/cwe-094
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/android-insecure-dex-loading
|
||||
* @tags security
|
||||
* external/cwe/cwe-094
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/jshell-injection
|
||||
* @tags security
|
||||
* external/cwe/cwe-094
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/javaee-expression-injection
|
||||
* @tags security
|
||||
* external/cwe/cwe-094
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @tags security
|
||||
* external/cwe/cwe-094
|
||||
* external/cwe/cwe-095
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/unsafe-eval
|
||||
* @tags security
|
||||
* external/cwe/cwe-094
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id java/spring-view-manipulation-implicit
|
||||
* @tags security
|
||||
* external/cwe/cwe-094
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id java/spring-view-manipulation
|
||||
* @tags security
|
||||
* external/cwe/cwe-094
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id java/tomcat-disabled-httponly
|
||||
* @tags security
|
||||
* external/cwe/cwe-1004
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/sensitive-cookie-not-httponly
|
||||
* @tags security
|
||||
* external/cwe/cwe-1004
|
||||
* experimental
|
||||
*/
|
||||
|
||||
/*
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @problem.severity error
|
||||
* @tags security
|
||||
* external/cwe/cwe-200
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @problem.severity warning
|
||||
* @tags security
|
||||
* external/cwe/cwe-200
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* @id java/possible-timing-attack-against-signature
|
||||
* @tags security
|
||||
* external/cwe/cwe-208
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/timing-attack-against-headers-value
|
||||
* @tags security
|
||||
* external/cwe/cwe-208
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -11,6 +11,7 @@
|
||||
* @id java/timing-attack-against-signature
|
||||
* @tags security
|
||||
* external/cwe/cwe-208
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @id java/jxbrowser/disabled-certificate-validation
|
||||
* @tags security
|
||||
* external/cwe/cwe-295
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/ignored-hostname-verification
|
||||
* @tags security
|
||||
* external/cwe/cwe-297
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @id java/insecure-ldaps-endpoint
|
||||
* @tags security
|
||||
* external/cwe/cwe-297
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/disabled-certificate-revocation-checking
|
||||
* @tags security
|
||||
* external/cwe/cwe-299
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
* @id java/hardcoded-jwt-key
|
||||
* @tags security
|
||||
* external/cwe/cwe-321
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -0,0 +1,154 @@
|
||||
/**
|
||||
* @name Weak encryption: Insufficient key size
|
||||
* @description Finds uses of encryption algorithms with too small a key size
|
||||
* @kind problem
|
||||
* @problem.severity warning
|
||||
* @precision medium
|
||||
* @id java/insufficient-key-size
|
||||
* @tags security
|
||||
* external/cwe/cwe-326
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
import semmle.code.java.security.Encryption
|
||||
import semmle.code.java.dataflow.TaintTracking
|
||||
|
||||
/** The Java class `java.security.spec.ECGenParameterSpec`. */
|
||||
class ECGenParameterSpec extends RefType {
|
||||
ECGenParameterSpec() { this.hasQualifiedName("java.security.spec", "ECGenParameterSpec") }
|
||||
}
|
||||
|
||||
/** The `init` method declared in `javax.crypto.KeyGenerator`. */
|
||||
class KeyGeneratorInitMethod extends Method {
|
||||
KeyGeneratorInitMethod() {
|
||||
this.getDeclaringType() instanceof KeyGenerator and
|
||||
this.hasName("init")
|
||||
}
|
||||
}
|
||||
|
||||
/** The `initialize` method declared in `java.security.KeyPairGenerator`. */
|
||||
class KeyPairGeneratorInitMethod extends Method {
|
||||
KeyPairGeneratorInitMethod() {
|
||||
this.getDeclaringType() instanceof KeyPairGenerator and
|
||||
this.hasName("initialize")
|
||||
}
|
||||
}
|
||||
|
||||
/** Returns the key size in the EC algorithm string */
|
||||
bindingset[algorithm]
|
||||
int getECKeySize(string algorithm) {
|
||||
algorithm.matches("sec%") and // specification such as "secp256r1"
|
||||
result = algorithm.regexpCapture("sec[p|t](\\d+)[a-zA-Z].*", 1).toInt()
|
||||
or
|
||||
algorithm.matches("X9.62%") and //specification such as "X9.62 prime192v2"
|
||||
result = algorithm.regexpCapture("X9\\.62 .*[a-zA-Z](\\d+)[a-zA-Z].*", 1).toInt()
|
||||
or
|
||||
(algorithm.matches("prime%") or algorithm.matches("c2tnb%")) and //specification such as "prime192v2"
|
||||
result = algorithm.regexpCapture(".*[a-zA-Z](\\d+)[a-zA-Z].*", 1).toInt()
|
||||
}
|
||||
|
||||
/** Taint configuration tracking flow from a key generator to a `init` method call. */
|
||||
class KeyGeneratorInitConfiguration extends TaintTracking::Configuration {
|
||||
KeyGeneratorInitConfiguration() { this = "KeyGeneratorInitConfiguration" }
|
||||
|
||||
override predicate isSource(DataFlow::Node source) {
|
||||
source.asExpr() instanceof JavaxCryptoKeyGenerator
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) {
|
||||
exists(MethodAccess ma |
|
||||
ma.getMethod() instanceof KeyGeneratorInitMethod and
|
||||
sink.asExpr() = ma.getQualifier()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/** Taint configuration tracking flow from a keypair generator to a `initialize` method call. */
|
||||
class KeyPairGeneratorInitConfiguration extends TaintTracking::Configuration {
|
||||
KeyPairGeneratorInitConfiguration() { this = "KeyPairGeneratorInitConfiguration" }
|
||||
|
||||
override predicate isSource(DataFlow::Node source) {
|
||||
source.asExpr() instanceof JavaSecurityKeyPairGenerator
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) {
|
||||
exists(MethodAccess ma |
|
||||
ma.getMethod() instanceof KeyPairGeneratorInitMethod and
|
||||
sink.asExpr() = ma.getQualifier()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/** Holds if a symmetric `KeyGenerator` implementing encryption algorithm `type` and initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
|
||||
bindingset[type]
|
||||
predicate hasShortSymmetricKey(MethodAccess ma, string msg, string type) {
|
||||
ma.getMethod() instanceof KeyGeneratorInitMethod and
|
||||
exists(
|
||||
JavaxCryptoKeyGenerator jcg, KeyGeneratorInitConfiguration cc, DataFlow::PathNode source,
|
||||
DataFlow::PathNode dest
|
||||
|
|
||||
jcg.getAlgoSpec().(StringLiteral).getValue() = type and
|
||||
source.getNode().asExpr() = jcg and
|
||||
dest.getNode().asExpr() = ma.getQualifier() and
|
||||
cc.hasFlowPath(source, dest)
|
||||
) and
|
||||
ma.getArgument(0).(IntegerLiteral).getIntValue() < 128 and
|
||||
msg = "Key size should be at least 128 bits for " + type + " encryption."
|
||||
}
|
||||
|
||||
/** Holds if an AES `KeyGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
|
||||
predicate hasShortAESKey(MethodAccess ma, string msg) { hasShortSymmetricKey(ma, msg, "AES") }
|
||||
|
||||
/** Holds if an asymmetric `KeyPairGenerator` implementing encryption algorithm `type` and initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
|
||||
bindingset[type]
|
||||
predicate hasShortAsymmetricKeyPair(MethodAccess ma, string msg, string type) {
|
||||
ma.getMethod() instanceof KeyPairGeneratorInitMethod and
|
||||
exists(
|
||||
JavaSecurityKeyPairGenerator jpg, KeyPairGeneratorInitConfiguration kc,
|
||||
DataFlow::PathNode source, DataFlow::PathNode dest
|
||||
|
|
||||
jpg.getAlgoSpec().(StringLiteral).getValue().toUpperCase() = type and
|
||||
source.getNode().asExpr() = jpg and
|
||||
dest.getNode().asExpr() = ma.getQualifier() and
|
||||
kc.hasFlowPath(source, dest)
|
||||
) and
|
||||
ma.getArgument(0).(IntegerLiteral).getIntValue() < 2048 and
|
||||
msg = "Key size should be at least 2048 bits for " + type + " encryption."
|
||||
}
|
||||
|
||||
/** Holds if a DSA `KeyPairGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
|
||||
predicate hasShortDSAKeyPair(MethodAccess ma, string msg) {
|
||||
hasShortAsymmetricKeyPair(ma, msg, "DSA") or hasShortAsymmetricKeyPair(ma, msg, "DH")
|
||||
}
|
||||
|
||||
/** Holds if a RSA `KeyPairGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
|
||||
predicate hasShortRSAKeyPair(MethodAccess ma, string msg) {
|
||||
hasShortAsymmetricKeyPair(ma, msg, "RSA")
|
||||
}
|
||||
|
||||
/** Holds if an EC `KeyPairGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
|
||||
predicate hasShortECKeyPair(MethodAccess ma, string msg) {
|
||||
ma.getMethod() instanceof KeyPairGeneratorInitMethod and
|
||||
exists(
|
||||
JavaSecurityKeyPairGenerator jpg, KeyPairGeneratorInitConfiguration kc,
|
||||
DataFlow::PathNode source, DataFlow::PathNode dest, ClassInstanceExpr cie
|
||||
|
|
||||
jpg.getAlgoSpec().(StringLiteral).getValue().matches("EC%") and // ECC variants such as ECDH and ECDSA
|
||||
source.getNode().asExpr() = jpg and
|
||||
dest.getNode().asExpr() = ma.getQualifier() and
|
||||
kc.hasFlowPath(source, dest) and
|
||||
DataFlow::localExprFlow(cie, ma.getArgument(0)) and
|
||||
ma.getArgument(0).getType() instanceof ECGenParameterSpec and
|
||||
getECKeySize(cie.getArgument(0).(StringLiteral).getValue()) < 256
|
||||
) and
|
||||
msg = "Key size should be at least 256 bits for EC encryption."
|
||||
}
|
||||
|
||||
from Expr e, string msg
|
||||
where
|
||||
hasShortAESKey(e, msg) or
|
||||
hasShortDSAKeyPair(e, msg) or
|
||||
hasShortRSAKeyPair(e, msg) or
|
||||
hasShortECKeyPair(e, msg)
|
||||
select e, msg
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/unsafe-tls-version
|
||||
* @tags security
|
||||
* external/cwe/cwe-327
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id java/unvalidated-cors-origin-set
|
||||
* @tags security
|
||||
* external/cwe/cwe-346
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/ip-address-spoofing
|
||||
* @tags security
|
||||
* external/cwe/cwe-348
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/jsonp-injection
|
||||
* @tags security
|
||||
* external/cwe/cwe-352
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @problem.severity warning
|
||||
* @tags security
|
||||
* external/cwe/cwe-400
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/unsafe-reflection
|
||||
* @tags security
|
||||
* external/cwe/cwe-470
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id java/main-method-in-enterprise-bean
|
||||
* @tags security
|
||||
* external/cwe/cwe-489
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
* @id java/main-method-in-web-components
|
||||
* @tags security
|
||||
* external/cwe/cwe-489
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
* @id java/struts-development-mode
|
||||
* @tags security
|
||||
* external/cwe/cwe-489
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
* @id java/unsafe-deserialization-rmi
|
||||
* @tags security
|
||||
* external/cwe/cwe-502
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @id java/unsafe-deserialization-spring-exporter-in-configuration-class
|
||||
* @tags security
|
||||
* external/cwe/cwe-502
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
* @id java/unsafe-deserialization-spring-exporter-in-xml-configuration
|
||||
* @tags security
|
||||
* external/cwe/cwe-502
|
||||
* experimental
|
||||
*/
|
||||
|
||||
import java
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user