use-of-weak-rsa-key-go

Sakshis · Sakshis · commit b6820c396d33 · 2024-12-16T07:26:51.000Z
diff --git a/rules/java/security/use-of-weak-rsa-key-go.yml b/rules/java/security/use-of-weak-rsa-key-go.yml
@@ -0,0 +1,37 @@
+id: use-of-weak-rsa-key-go
+language: go
+severity: warning
+message: >-
+  RSA keys should be at least 2048 bits.
+note: >-
+  [CWE-326] Inadequate Encryption Strength.
+  [REFERENCES]
+      - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
+utils:
+  statement_match_pattern_one:
+      kind: expression_list
+      all:
+        - has:
+           stopBy: end
+           kind: selector_expression
+           pattern: $JWT
+        - has:
+           stopBy: end
+           kind: argument_list
+        - has:
+           stopBy: end
+           any:
+             - kind: float_literal
+               pattern: $BITS
+             - kind: int_literal
+               pattern: $BITS
+rule:
+  kind: expression_list
+  any:
+    - matches: statement_match_pattern_one
+constraints:
+  JWT:
+    regex: (rsa.GenerateMultiPrimeKey|rsa.GenerateKey)
+
+  BITS:
+    regex: ^(-?(0|[1-9][0-9]{0,2}|1[0-9]{3}|20[0-3][0-9]|204[0-7])(\.[0-9]+)?|0|-[1-9][0-9]*|-[1-9][0-9]{2,}|-1[0-9]{3}|-20[0-3][0-9]|-204[0-7])$
diff --git a/tests/__snapshots__/use-of-weak-rsa-key-go-snapshot.yml b/tests/__snapshots__/use-of-weak-rsa-key-go-snapshot.yml
@@ -0,0 +1,78 @@
+id: use-of-weak-rsa-key-go
+snapshots:
+  ? |
+    pvk, err := rsa.GenerateKey(rand.Reader, -1929)
+  : labels:
+    - source: rsa.GenerateKey(rand.Reader, -1929)
+      style: primary
+      start: 12
+      end: 47
+    - source: rsa.GenerateKey
+      style: secondary
+      start: 12
+      end: 27
+    - source: (rand.Reader, -1929)
+      style: secondary
+      start: 27
+      end: 47
+    - source: '1929'
+      style: secondary
+      start: 42
+      end: 46
+  ? |
+    pvk, err := rsa.GenerateKey(rand.Reader, 102.5)
+  : labels:
+    - source: rsa.GenerateKey(rand.Reader, 102.5)
+      style: primary
+      start: 12
+      end: 47
+    - source: rsa.GenerateKey
+      style: secondary
+      start: 12
+      end: 27
+    - source: (rand.Reader, 102.5)
+      style: secondary
+      start: 27
+      end: 47
+    - source: '102.5'
+      style: secondary
+      start: 41
+      end: 46
+  ? |
+    pvk, err := rsa.GenerateKey(rand.Reader, 1025)
+  : labels:
+    - source: rsa.GenerateKey(rand.Reader, 1025)
+      style: primary
+      start: 12
+      end: 46
+    - source: rsa.GenerateKey
+      style: secondary
+      start: 12
+      end: 27
+    - source: (rand.Reader, 1025)
+      style: secondary
+      start: 27
+      end: 46
+    - source: '1025'
+      style: secondary
+      start: 41
+      end: 45
+  ? |
+    pvk, err := rsa.GenerateKey(rand.Reader, 192)
+  : labels:
+    - source: rsa.GenerateKey(rand.Reader, 192)
+      style: primary
+      start: 12
+      end: 45
+    - source: rsa.GenerateKey
+      style: secondary
+      start: 12
+      end: 27
+    - source: (rand.Reader, 192)
+      style: secondary
+      start: 27
+      end: 45
+    - source: '192'
+      style: secondary
+      start: 41
+      end: 44
diff --git a/tests/java/use-of-weak-rsa-key-go-test.yml b/tests/java/use-of-weak-rsa-key-go-test.yml
@@ -0,0 +1,13 @@
+id: use-of-weak-rsa-key-go
+valid:
+  - |
+    rsa.GenerateKey(rand.Reader, 2048)
+invalid:
+  - |
+    pvk, err := rsa.GenerateKey(rand.Reader, 1025)
+  - |
+    pvk, err := rsa.GenerateKey(rand.Reader, -1929)
+  - |
+    pvk, err := rsa.GenerateKey(rand.Reader, 102.5)
+  - |
+    pvk, err := rsa.GenerateKey(rand.Reader, 192)
