Skip to content

Commit bba541c

Browse files
bdrodesbdrodes
committed
Merge remote-tracking branch 'upstream/java-crypto-check' into santander-java-crypto-check
2 parents d39c8d1 + f38ab45 commit bba541c

File tree

11 files changed

+218
-1
lines changed

11 files changed

+218
-1
lines changed

‎java/ql/src/experimental/quantum/Analysis/InsecureNonceGeneration.ql‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* @name Insecure nonce at a cipher operation
3+
* @id java/quantum/insecure-nonce
4+
* @description A nonce is generated from a source that is not secure. This can lead to
5+
* vulnerabilities such as replay attacks or key recovery.
6+
* @kind problem
7+
* @problem.severity error
8+
* @precision high
9+
* @tags quantum
10+
* experimental
11+
*/
12+
13+
import experimental.quantum.Language
14+
15+
predicate isInsecureNonceSource(Crypto::NonceArtifactNode n, Crypto::NodeBase src) {
16+
src = n.getSourceNode() and
17+
not src.asElement() instanceof SecureRandomnessInstance
18+
}
19+
20+
from Crypto::KeyOperationNode op, Crypto::NodeBase src
21+
where isInsecureNonceSource(op.getANonce(), src)
22+
select op, "Operation uses insecure nonce source $@", src, src.toString()

‎java/ql/src/experimental/quantum/Analysis/NonAESGCMCipher.ql‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* @name Cipher not AES-GCM mode
3+
* @id java/quantum/non-aes-gcm
4+
* @description An AES cipher is in use without GCM
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags quantum
9+
* experimental
10+
*/
11+
12+
import experimental.quantum.Language
13+
14+
class NonAESGCMAlgorithmNode extends Crypto::KeyOperationAlgorithmNode {
15+
NonAESGCMAlgorithmNode() {
16+
this.getAlgorithmType() = Crypto::KeyOpAlg::TSymmetricCipher(Crypto::KeyOpAlg::AES()) and
17+
this.getModeOfOperation().getModeType() != Crypto::KeyOpAlg::GCM()
18+
}
19+
}
20+
21+
from Crypto::KeyOperationNode op, Crypto::KeyOperationOutputNode codeNode
22+
where op.getAKnownAlgorithm() instanceof NonAESGCMAlgorithmNode and
23+
codeNode = op.getAnOutputArtifact()
24+
select op, "Non-AES-GCM instance."

‎java/ql/src/experimental/quantum/Analysis/NonceReuse.ql‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/**
2+
* @name Reuse of cryptographic nonce
3+
* @description Reuse of nonce in cryptographic operations can lead to vulnerabilities.
4+
* @id java/quantum/reused-nonce
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision medium
8+
* @tags quantum
9+
* experimental
10+
*/
11+
12+
import java
13+
import ArtifactReuse
14+
15+
from Crypto::NonceArtifactNode nonce1, Crypto::NonceArtifactNode nonce2
16+
where isArtifactReuse(nonce1, nonce2)
17+
select nonce1, "Reuse with nonce $@", nonce2, nonce2.toString()

‎java/ql/src/experimental/quantum/Analysis/UnknownKDFIterationCount.ql‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
* @id java/quantum/unknown-kdf-iteration-count
55
* @kind problem
66
* @precision medium
7-
* @severity warning
87
* @tags quantum
98
* experimental
109
*/

‎java/ql/src/experimental/quantum/Analysis/WeakAsymmetric.ql‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* @name Weak Asymetric Key Size
3+
* @id java/quantum/weak-asymmetric-key-size
4+
* @description An asymmetric cipher with a short key size is in use
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags quantum
9+
* experimental
10+
*/
11+
12+
import java
13+
import experimental.quantum.Language
14+
15+
from Crypto::KeyOperationAlgorithmNode op, DataFlow::Node configSrc, int keySize, string algName
16+
where
17+
keySize = op.getKeySizeFixed() and
18+
keySize < 2048 and
19+
algName = op.getAlgorithmName() and
20+
// Can't be an elliptic curve
21+
not Crypto::isEllipticCurveAlgorithmName(algName)
22+
select op,
23+
"Use of weak asymmetric key size (int bits)" + keySize.toString() + " for algorithm " +
24+
algName.toString() + " at config source $@", configSrc, configSrc.toString()

‎java/ql/src/experimental/quantum/Analysis/WeakBlockModes.ql‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* @name Weak AES Block mode
3+
* @id java/quantum/weak-block-modes
4+
* @description An AES cipher is in use with an insecure block mode
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags quantum
9+
* experimental
10+
*/
11+
12+
import java
13+
import experimental.quantum.Language
14+
15+
class WeakAESBlockModeAlgNode extends Crypto::KeyOperationAlgorithmNode {
16+
WeakAESBlockModeAlgNode() {
17+
this.getAlgorithmType() = Crypto::KeyOpAlg::TSymmetricCipher(Crypto::KeyOpAlg::AES()) and
18+
(this.getModeOfOperation().getModeType() = Crypto::KeyOpAlg::ECB() or
19+
this.getModeOfOperation().getModeType() = Crypto::KeyOpAlg::CFB() or
20+
this.getModeOfOperation().getModeType() = Crypto::KeyOpAlg::OFB() or
21+
this.getModeOfOperation().getModeType() = Crypto::KeyOpAlg::CTR()
22+
)
23+
}
24+
}
25+
26+
from Crypto::KeyOperationNode op, Crypto::KeyOperationOutputNode codeNode
27+
where op.getAKnownAlgorithm() instanceof WeakAESBlockModeAlgNode and
28+
codeNode = op.getAnOutputArtifact()
29+
select op, "Weak AES block mode instance."

‎java/ql/src/experimental/quantum/Analysis/WeakHashing.ql‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* @name Weak hashes
3+
* @description Finds uses of cryptographic hashing algorithms that are unapproved or otherwise weak.
4+
* @id java/quantum/slices/weak-hashes
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags external/cwe/cwe-327
9+
*/
10+
11+
import java
12+
import experimental.quantum.Language
13+
14+
from Crypto::HashAlgorithmNode alg, string name, string msg
15+
where
16+
name = alg.getAlgorithmName() and
17+
not name in ["SHA256", "SHA384", "SHA512", "SHA-256", "SHA-384", "SHA-512"] and
18+
msg = "Use of unapproved hash algorithm or API " + name + "."
19+
select alg, msg

‎java/ql/src/experimental/quantum/Analysis/WeakKDFIterationCount.ql‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* @name Weak known key derivation function iteration count
3+
* @description Detects key derivation operations with a known weak iteration count.
4+
* @id java/quantum/weak-kdf-iteration-count
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags quantum
9+
* experimental
10+
*/
11+
12+
import java
13+
import experimental.quantum.Language
14+
15+
from Crypto::KeyDerivationOperationNode op, Literal l
16+
where
17+
op.getIterationCount().asElement() = l and
18+
l.getValue().toInt() < 100000
19+
select op, "Key derivation operation configures iteration count below 100k: $@", l,
20+
l.getValue().toString()

‎java/ql/src/experimental/quantum/Analysis/WeakKDFKeySize.ql‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* @name Weak known key derivation function output length
3+
* @description Detects key derivation operations with a known weak output length
4+
* @id java/quantum/weak-kdf-iteration-count
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags quantum
9+
* experimental
10+
*/
11+
12+
import java
13+
import experimental.quantum.Language
14+
15+
from Crypto::KeyDerivationOperationNode op, Literal l
16+
where
17+
op.getOutputKeySize().asElement() = l and
18+
l.getValue().toInt() < 256
19+
select op, "Key derivation operation configures output key length below 256: $@", l,
20+
l.getValue().toString()

‎java/ql/src/experimental/quantum/Analysis/WeakRSA.ql‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* @name Cipher is Weak RSA Implementation
3+
* @id java/quantum/weak-rsa
4+
* @description RSA with a key length <2048 found
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags quantum
9+
* experimental
10+
*/
11+
12+
import experimental.quantum.Language
13+
14+
class WeakRSAAlgorithmNode extends Crypto::KeyOperationAlgorithmNode {
15+
WeakRSAAlgorithmNode() {
16+
this.getAlgorithmType() = Crypto::KeyOpAlg::TAsymmetricCipher(Crypto::KeyOpAlg::RSA()) and
17+
this.getKeySizeFixed() < 2048
18+
}
19+
}
20+
21+
from Crypto::KeyOperationNode op, string message
22+
where op.getAKnownAlgorithm() instanceof WeakRSAAlgorithmNode and
23+
message = "Weak RSA instance found with key length <2048"
24+
select op, message

0 commit comments

Comments
 (0)