Skip to content

Commit 7c10c88

Browse files
ESS-ENNESS-ENN
committed
insecure-cipher-algorithm-rc4-python
1 parent f732bc5 commit 7c10c88

File tree

3 files changed

+268
-0
lines changed

3 files changed

+268
-0
lines changed

‎rules/python/security/insecure-cipher-algorithm-rc4-python.yml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
id: insecure-cipher-algorithm-rc4-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
Detected ARC4 cipher algorithm which is considered insecure. This
6+
algorithm is not cryptographically secure and can be reversed easily. Use
7+
secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block
8+
cipher such as AES with a block size of 128 bits. When using a block
9+
cipher, use a modern mode of operation that also provides authentication,
10+
such as GCM.
11+
note: >-
12+
[CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
13+
[REFERENCES]
14+
- https://cwe.mitre.org/data/definitions/326.html
15+
- https://www.pycryptodome.org/src/cipher/cipher
16+
utils:
17+
MATCH_PATTERN_arc4.new:
18+
kind: call
19+
all:
20+
- has:
21+
stopBy: end
22+
kind: attribute
23+
all:
24+
- has:
25+
stopBy: neighbor
26+
kind: identifier
27+
pattern: $X
28+
- has:
29+
stopBy: neighbor
30+
kind: identifier
31+
regex: '^new$'
32+
- has:
33+
stopBy: neighbor
34+
kind: argument_list
35+
has:
36+
stopBy: neighbor
37+
kind: identifier
38+
- inside:
39+
stopBy: end
40+
kind: expression_statement
41+
follows:
42+
stopBy: end
43+
kind: import_from_statement
44+
all:
45+
- has:
46+
stopBy: neighbor
47+
kind: dotted_name
48+
all:
49+
- has:
50+
stopBy: neighbor
51+
kind: identifier
52+
regex: '^Crypto$|^Cryptodome$'
53+
- has:
54+
stopBy: neighbor
55+
kind: identifier
56+
regex: '^Cipher$'
57+
- has:
58+
stopBy: neighbor
59+
kind: aliased_import
60+
all:
61+
- has:
62+
stopBy: neighbor
63+
kind: dotted_name
64+
has:
65+
stopBy: neighbor
66+
kind: identifier
67+
regex: '^ARC4$'
68+
- has:
69+
stopBy: neighbor
70+
kind: identifier
71+
pattern: $X
72+
73+
rule:
74+
kind: call
75+
any:
76+
- matches: MATCH_PATTERN_arc4.new
77+
- pattern: Cryptodome.Cipher.ARC4.new($$$)
78+
- pattern: Crypto.Cipher.ARC4.new($$$)
79+
80+
81+
82+
83+
84+
85+

‎tests/__snapshots__/insecure-cipher-algorithm-rc4-python-snapshot.yml

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
id: insecure-cipher-algorithm-rc4-python
2+
snapshots:
3+
? |
4+
Crypto.Cipher.ARC4.new()
5+
: labels:
6+
- source: Crypto.Cipher.ARC4.new()
7+
style: primary
8+
start: 0
9+
end: 24
10+
? |
11+
Crypto.Cipher.ARC4.new(adasfdasfs)
12+
: labels:
13+
- source: Crypto.Cipher.ARC4.new(adasfdasfs)
14+
style: primary
15+
start: 0
16+
end: 34
17+
? |
18+
Cryptodome.Cipher.ARC4.new()
19+
: labels:
20+
- source: Cryptodome.Cipher.ARC4.new()
21+
style: primary
22+
start: 0
23+
end: 28
24+
Cryptodome.Cipher.ARC4.new(asdsd):
25+
labels:
26+
- source: Cryptodome.Cipher.ARC4.new(asdsd)
27+
style: primary
28+
start: 0
29+
end: 33
30+
? |
31+
from Crypto.Cipher import ARC4 as pycrypto_arc4
32+
cipher = pycrypto_arc4.new(tempkey)
33+
: labels:
34+
- source: pycrypto_arc4.new(tempkey)
35+
style: primary
36+
start: 57
37+
end: 83
38+
- source: pycrypto_arc4
39+
style: secondary
40+
start: 57
41+
end: 70
42+
- source: new
43+
style: secondary
44+
start: 71
45+
end: 74
46+
- source: pycrypto_arc4.new
47+
style: secondary
48+
start: 57
49+
end: 74
50+
- source: tempkey
51+
style: secondary
52+
start: 75
53+
end: 82
54+
- source: (tempkey)
55+
style: secondary
56+
start: 74
57+
end: 83
58+
- source: Crypto
59+
style: secondary
60+
start: 5
61+
end: 11
62+
- source: Cipher
63+
style: secondary
64+
start: 12
65+
end: 18
66+
- source: Crypto.Cipher
67+
style: secondary
68+
start: 5
69+
end: 18
70+
- source: ARC4
71+
style: secondary
72+
start: 26
73+
end: 30
74+
- source: ARC4
75+
style: secondary
76+
start: 26
77+
end: 30
78+
- source: pycrypto_arc4
79+
style: secondary
80+
start: 34
81+
end: 47
82+
- source: ARC4 as pycrypto_arc4
83+
style: secondary
84+
start: 26
85+
end: 47
86+
- source: from Crypto.Cipher import ARC4 as pycrypto_arc4
87+
style: secondary
88+
start: 0
89+
end: 47
90+
- source: cipher = pycrypto_arc4.new(tempkey)
91+
style: secondary
92+
start: 48
93+
end: 83
94+
? |
95+
from Cryptodome.Cipher import ARC4 as pycryptodomex_arc4
96+
cipher = pycryptodomex_arc4.new(tempkey)
97+
: labels:
98+
- source: pycryptodomex_arc4.new(tempkey)
99+
style: primary
100+
start: 66
101+
end: 97
102+
- source: pycryptodomex_arc4
103+
style: secondary
104+
start: 66
105+
end: 84
106+
- source: new
107+
style: secondary
108+
start: 85
109+
end: 88
110+
- source: pycryptodomex_arc4.new
111+
style: secondary
112+
start: 66
113+
end: 88
114+
- source: tempkey
115+
style: secondary
116+
start: 89
117+
end: 96
118+
- source: (tempkey)
119+
style: secondary
120+
start: 88
121+
end: 97
122+
- source: Cryptodome
123+
style: secondary
124+
start: 5
125+
end: 15
126+
- source: Cipher
127+
style: secondary
128+
start: 16
129+
end: 22
130+
- source: Cryptodome.Cipher
131+
style: secondary
132+
start: 5
133+
end: 22
134+
- source: ARC4
135+
style: secondary
136+
start: 30
137+
end: 34
138+
- source: ARC4
139+
style: secondary
140+
start: 30
141+
end: 34
142+
- source: pycryptodomex_arc4
143+
style: secondary
144+
start: 38
145+
end: 56
146+
- source: ARC4 as pycryptodomex_arc4
147+
style: secondary
148+
start: 30
149+
end: 56
150+
- source: from Cryptodome.Cipher import ARC4 as pycryptodomex_arc4
151+
style: secondary
152+
start: 0
153+
end: 56
154+
- source: cipher = pycryptodomex_arc4.new(tempkey)
155+
style: secondary
156+
start: 57
157+
end: 97

‎tests/python/insecure-cipher-algorithm-rc4-python-test.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: insecure-cipher-algorithm-rc4-python
2+
valid:
3+
- |
4+
cipher = AES.new(key, AES.MODE_EAX, nonce=nonce)
5+
plaintext = cipher.decrypt(ciphertext)
6+
try:
7+
cipher.verify(tag)
8+
print("The message is authentic:", plaintext)
9+
except ValueError:
10+
print("Key incorrect or message corrupted")
11+
12+
invalid:
13+
- |
14+
from Cryptodome.Cipher import ARC4 as pycryptodomex_arc4
15+
cipher = pycryptodomex_arc4.new(tempkey)
16+
- |
17+
from Crypto.Cipher import ARC4 as pycrypto_arc4
18+
cipher = pycrypto_arc4.new(tempkey)
19+
- |
20+
Crypto.Cipher.ARC4.new()
21+
- |
22+
Crypto.Cipher.ARC4.new(adasfdasfs)
23+
- |
24+
Cryptodome.Cipher.ARC4.new()
25+
- |
26+
Cryptodome.Cipher.ARC4.new(asdsd)

0 commit comments

Comments
 (0)