use-of-rc2-java

Sakshis · Sakshis · commit 0e97f5862459 · 2024-12-16T07:22:42.000Z
diff --git a/rules/java/security/use-of-rc2-java.yml b/rules/java/security/use-of-rc2-java.yml
@@ -0,0 +1,34 @@
+id: use-of-rc2-java
+language: java
+severity: warning
+message: >-
+  Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and
+  is therefore considered non-compliant. Instead, use a strong, secure.
+note: >-
+  [CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
+  [REFERENCES]
+      - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
+      - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
+rule:
+  any:
+    - pattern: $CIPHER.getInstance("RC2")
+    - pattern: $CIPHER.getInstance($R)
+      inside:
+        stopBy: end
+        kind: program
+        has:
+          stopBy: end
+          kind: local_variable_declaration
+          has:
+            stopBy: end
+            kind: variable_declarator
+            all:
+              - has:
+                  stopBy: neighbor
+                  kind: identifier
+                  pattern: $R
+              - has:
+                  stopBy: neighbor
+                  kind: string_literal
+                  regex: ^"RC2"$
+
diff --git a/tests/__snapshots__/use-of-rc2-java-snapshot.yml b/tests/__snapshots__/use-of-rc2-java-snapshot.yml
@@ -0,0 +1,70 @@
+id: use-of-rc2-java
+snapshots:
+  ? |
+    public void testRC2InMap() {
+    Map<String, Cipher> cipherMap = new HashMap<>();
+    cipherMap.put("RC2", Cipher.getInstance("RC2"));
+    }
+  : labels:
+    - source: Cipher.getInstance("RC2")
+      style: primary
+      start: 99
+      end: 124
+  ? |
+    public void testRC2InSwitch() {
+    String algorithm = "RC2";
+    switch (algorithm) {
+      case "RC2":
+        try {
+          Cipher.getInstance(algorithm);
+        } catch (Exception e) {
+          e.printStackTrace();
+        }
+        break;
+    }
+    }
+  : labels:
+    - source: Cipher.getInstance(algorithm)
+      style: primary
+      start: 109
+      end: 138
+    - source: algorithm
+      style: secondary
+      start: 39
+      end: 48
+    - source: '"RC2"'
+      style: secondary
+      start: 51
+      end: 56
+    - source: algorithm = "RC2"
+      style: secondary
+      start: 39
+      end: 56
+    - source: String algorithm = "RC2";
+      style: secondary
+      start: 32
+      end: 57
+    - source: |
+        public void testRC2InSwitch() {
+        String algorithm = "RC2";
+        switch (algorithm) {
+          case "RC2":
+            try {
+              Cipher.getInstance(algorithm);
+            } catch (Exception e) {
+              e.printStackTrace();
+            }
+            break;
+        }
+        }
+      style: secondary
+      start: 0
+      end: 216
+  ? |
+    useCipher(Cipher.getInstance("RC2"));
+    Cipher.getInstance("RC2");
+  : labels:
+    - source: Cipher.getInstance("RC2")
+      style: primary
+      start: 10
+      end: 35
diff --git a/tests/java/use-of-rc2-java-test.yml b/tests/java/use-of-rc2-java-test.yml
@@ -0,0 +1,39 @@
+id: use-of-rc2-java
+valid:
+  - |
+    Cipher.getInstance("AES/CBC/PKCS7PADDING");
+invalid:
+  - |
+    useCipher(Cipher.getInstance("RC2"));
+    Cipher.getInstance("RC2");
+  - |
+    public void testRC2InSwitch() {
+    String algorithm = "RC2";
+    switch (algorithm) {
+      case "RC2":
+        try {
+          Cipher.getInstance(algorithm);
+        } catch (Exception e) {
+          e.printStackTrace();
+        }
+        break;
+    }
+    }
+  - |
+    public void testRC2InMap() {
+    Map<String, Cipher> cipherMap = new HashMap<>();
+    cipherMap.put("RC2", Cipher.getInstance("RC2"));
+    }
+  - |
+    public void testRC2InSwitch() {
+    String algorithm = "RC2";
+    switch (algorithm) {
+      case "RC2":
+        try {
+          Cipher.getInstance(algorithm);
+        } catch (Exception e) {
+          e.printStackTrace();
+        }
+        break;
+    }
+    }
