Skip to content

Commit a248264

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add security rules for weak encryption practices in Java and Kotlin (#82)
* des-is-deprecated-kotlin * rsa-no-padding-java * modification in des-is-deprecated-java --------- Co-authored-by: Sakshis <sakshil@abc.com>
1 parent a27de88 commit a248264

File tree

7 files changed

+73
-2
lines changed

7 files changed

+73
-2
lines changed

‎rules/java/security/des-is-deprecated-java.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@ note: >-
1111
- https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
1212
rule:
1313
pattern: $CIPHER.getInstance($SAS)
14-
constraints:
14+
constraints:
1515
SAS:
16-
regex: "DES"
16+
regex: ^".*/DES/.*"|"DES"|"DES/.*"$

‎rules/java/security/rsa-no-padding-java.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
id: rsa-no-padding-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
Using RSA without OAEP mode weakens the encryption.
6+
note: >-
7+
[CWE-326] Inadequate Encryption Strength
8+
[REFERENCES]
9+
- https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/
10+
rule:
11+
pattern: $YST.getInstance($MODE)
12+
constraints:
13+
MODE:
14+
regex: 'RSA/[Nn][Oo][Nn][Ee]/NoPadding'

‎rules/kotlin/security/des-is-deprecated-kotlin.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: des-is-deprecated-kotlin
2+
severity: warning
3+
language: kotlin
4+
message: >-
5+
DES is considered deprecated. AES is the recommended cipher. Upgrade to
6+
use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
7+
for more information.
8+
note: >-
9+
[CWE-326] Inadequate Encryption Strength.
10+
[REFERENCES]
11+
- https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
12+
rule:
13+
pattern: $CIPHER.getInstance($SAS)
14+
constraints:
15+
SAS:
16+
regex: ^"DES/.*"|"DES"$

‎tests/__snapshots__/des-is-deprecated-kotlin-snapshot.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
id: des-is-deprecated-kotlin
2+
snapshots:
3+
? |
4+
Cipher.getInstance("DES/ECB/PKCS5Padding");
5+
: labels:
6+
- source: Cipher.getInstance("DES/ECB/PKCS5Padding")
7+
style: primary
8+
start: 0
9+
end: 42

‎tests/__snapshots__/rsa-no-padding-java-snapshot.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: rsa-no-padding-java
2+
snapshots:
3+
? |
4+
Cipher.getInstance("RSA/NONE/NoPadding");
5+
: labels:
6+
- source: Cipher.getInstance("RSA/NONE/NoPadding")
7+
style: primary
8+
start: 0
9+
end: 40
10+
? |
11+
Cipher.getInstance("RSA/None/NoPadding");
12+
: labels:
13+
- source: Cipher.getInstance("RSA/None/NoPadding")
14+
style: primary
15+
start: 0
16+
end: 40

‎tests/java/rsa-no-padding-java-test.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
id: rsa-no-padding-java
2+
valid:
3+
- |
4+
Cipher.getInstance("RSA/ECB/OAEPWithMD5AndMGF1Padding");
5+
invalid:
6+
- |
7+
Cipher.getInstance("RSA/None/NoPadding");
8+
- |
9+
Cipher.getInstance("RSA/NONE/NoPadding");

‎tests/kotlin/des-is-deprecated-kotlin-test.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
id: des-is-deprecated-kotlin
2+
valid:
3+
- |
4+
Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
5+
invalid:
6+
- |
7+
Cipher.getInstance("DES/ECB/PKCS5Padding");

0 commit comments

Comments
 (0)