Skip to content

Commit 9911c16

Browse files
ESS-ENNESS-ENN
committed
no-null-cipher-java
1 parent df44e6c commit 9911c16

File tree

4 files changed

+184
-0
lines changed

4 files changed

+184
-0
lines changed

‎rules/java/security/no-null-cipher-java.yml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
id: no-null-cipher-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
NullCipher was detected. This will not encrypt anything; the cipher
6+
text will be the same as the plain text. Use a valid, secure cipher:
7+
Cipher.getInstance("AES/CBC/PKCS7PADDING"). See
8+
https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
9+
for more information.
10+
note: >-
11+
[CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
12+
[REFERENCES]
13+
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
14+
15+
ast-grep-essentials: true
16+
17+
rule:
18+
any:
19+
- kind: local_variable_declaration
20+
not:
21+
any:
22+
- has:
23+
stopBy: end
24+
kind: local_variable_declaration
25+
- kind: expression_statement
26+
not:
27+
has:
28+
stopBy: end
29+
kind: local_variable_declaration
30+
- kind: field_declaration
31+
has:
32+
stopBy: end
33+
any:
34+
- pattern: new NullCipher($$$)
35+
- pattern: new javax.crypto.NullCipher($$$)
36+
not:
37+
all:
38+
- inside:
39+
stopBy: end
40+
kind: ERROR
41+
- has:
42+
stopBy: end
43+
kind: ERROR
44+
45+

‎tests/__snapshots__/no-null-cipher-java-snapshot.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
id: no-null-cipher-java
2+
snapshots:
3+
? |
4+
Cipher doNothingCihper = new NullCipher();
5+
new javax.crypto.NullCipher();
6+
: labels:
7+
- source: Cipher doNothingCihper = new NullCipher();
8+
style: primary
9+
start: 0
10+
end: 42
11+
- source: new NullCipher()
12+
style: secondary
13+
start: 25
14+
end: 41

‎tests/__snapshots__/use-of-aes-ecb-java-snapshot.yml

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
id: use-of-aes-ecb-java
2+
snapshots:
3+
? |
4+
Cipher.getInstance("AES/ECB")
5+
: labels:
6+
- source: Cipher.getInstance("AES/ECB")
7+
style: primary
8+
start: 0
9+
end: 29
10+
- source: getInstance
11+
style: secondary
12+
start: 7
13+
end: 18
14+
- source: AES/ECB
15+
style: secondary
16+
start: 20
17+
end: 27
18+
- source: '"AES/ECB"'
19+
style: secondary
20+
start: 19
21+
end: 28
22+
- source: ("AES/ECB")
23+
style: secondary
24+
start: 18
25+
end: 29
26+
? |
27+
Cipher.getInstance("AES/ECB/ISO10126Padding")
28+
: labels:
29+
- source: Cipher.getInstance("AES/ECB/ISO10126Padding")
30+
style: primary
31+
start: 0
32+
end: 45
33+
- source: getInstance
34+
style: secondary
35+
start: 7
36+
end: 18
37+
- source: AES/ECB/ISO10126Padding
38+
style: secondary
39+
start: 20
40+
end: 43
41+
- source: '"AES/ECB/ISO10126Padding"'
42+
style: secondary
43+
start: 19
44+
end: 44
45+
- source: ("AES/ECB/ISO10126Padding")
46+
style: secondary
47+
start: 18
48+
end: 45
49+
? |
50+
Cipher.getInstance("AES/ECB/NoPadding")
51+
: labels:
52+
- source: Cipher.getInstance("AES/ECB/NoPadding")
53+
style: primary
54+
start: 0
55+
end: 39
56+
- source: getInstance
57+
style: secondary
58+
start: 7
59+
end: 18
60+
- source: AES/ECB/NoPadding
61+
style: secondary
62+
start: 20
63+
end: 37
64+
- source: '"AES/ECB/NoPadding"'
65+
style: secondary
66+
start: 19
67+
end: 38
68+
- source: ("AES/ECB/NoPadding")
69+
style: secondary
70+
start: 18
71+
end: 39
72+
? |
73+
Cipher.getInstance("AES/ECB/PKCS5Padding")
74+
: labels:
75+
- source: Cipher.getInstance("AES/ECB/PKCS5Padding")
76+
style: primary
77+
start: 0
78+
end: 42
79+
- source: getInstance
80+
style: secondary
81+
start: 7
82+
end: 18
83+
- source: AES/ECB/PKCS5Padding
84+
style: secondary
85+
start: 20
86+
end: 40
87+
- source: '"AES/ECB/PKCS5Padding"'
88+
style: secondary
89+
start: 19
90+
end: 41
91+
- source: ("AES/ECB/PKCS5Padding")
92+
style: secondary
93+
start: 18
94+
end: 42
95+
? |
96+
Cipher.getInstance("AES/ECB/PKCS7Padding")
97+
: labels:
98+
- source: Cipher.getInstance("AES/ECB/PKCS7Padding")
99+
style: primary
100+
start: 0
101+
end: 42
102+
- source: getInstance
103+
style: secondary
104+
start: 7
105+
end: 18
106+
- source: AES/ECB/PKCS7Padding
107+
style: secondary
108+
start: 20
109+
end: 40
110+
- source: '"AES/ECB/PKCS7Padding"'
111+
style: secondary
112+
start: 19
113+
end: 41
114+
- source: ("AES/ECB/PKCS7Padding")
115+
style: secondary
116+
start: 18
117+
end: 42

‎tests/java/no-null-cipher-java-test.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
id: no-null-cipher-java
2+
valid:
3+
- |
4+
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
5+
invalid:
6+
- |
7+
Cipher doNothingCihper = new NullCipher();
8+
new javax.crypto.NullCipher();

0 commit comments

Comments
 (0)