desede-is-deprecated-kotlin

Sakshis · Sakshis · commit b76f3bea2e69 · 2024-12-05T11:43:29.000Z
diff --git a/rules/kotlin/security/desede-is-deprecated-kotlin.yml b/rules/kotlin/security/desede-is-deprecated-kotlin.yml
@@ -0,0 +1,69 @@
+id: desede-is-deprecated-kotlin
+language: kotlin
+severity: warning
+message: >-
+    Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.
+note: >-
+  [CWE-326]: Inadequate Encryption Strength
+  [OWASP A03:2017]: Sensitive Data Exposure
+  [OWASP A02:2021]: Cryptographic Failures
+  [REFERENCES]
+      - https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE
+      - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
+utils:
+  match_call_expression:
+    kind: call_expression
+    all:
+        - has:
+            kind: navigation_expression
+        - has:
+            stopBy: end
+            kind: call_suffix
+            all:
+                - has:
+                    stopBy: end
+                    kind: value_arguments
+                - has:
+                    stopBy: end
+                    kind: value_argument
+                    has:
+                        stopBy: end
+                        kind: string_literal 
+                        regex: 'DESede'
+    inside:
+        kind: infix_expression
+        precedes:
+            kind: call_expression
+  match_key_generator:
+    kind: call_expression   
+    all:
+        - has:
+            kind: navigation_expression
+            all:
+                - has:
+                    kind: navigation_expression
+                - has:
+                    stopBy: end
+                    kind: navigation_suffix
+                    has:
+                        stopBy: end
+                        kind: simple_identifier
+                        regex: '^KeyGenerator$'
+        - has:
+            stopBy: end
+            kind: call_suffix   
+            all:
+                - has:
+                    stopBy: end
+                    kind: value_arguments
+                - has:
+                    stopBy: end
+                    kind: value_argument
+                    has:
+                        stopBy: end
+                        kind: string_literal
+                        regex: 'DES'              
+rule:
+    any:
+      - matches: match_call_expression
+      - matches: match_key_generator
diff --git a/tests/__snapshots__/desede-is-deprecated-kotlin-snapshot.yml b/tests/__snapshots__/desede-is-deprecated-kotlin-snapshot.yml
@@ -0,0 +1,76 @@
+id: desede-is-deprecated-kotlin
+snapshots:
+  ? |
+    Cipher c = Cipher.getInstance("kDESede/ECB/PKCS5Padding");
+    c.init(Cipher.ENCRYPT_MODE, k, iv);
+  : labels:
+    - source: Cipher.getInstance("kDESede/ECB/PKCS5Padding")
+      style: primary
+      start: 11
+      end: 57
+    - source: Cipher.getInstance
+      style: secondary
+      start: 11
+      end: 29
+    - source: ("kDESede/ECB/PKCS5Padding")
+      style: secondary
+      start: 29
+      end: 57
+    - source: '"kDESede/ECB/PKCS5Padding"'
+      style: secondary
+      start: 30
+      end: 56
+    - source: '"kDESede/ECB/PKCS5Padding"'
+      style: secondary
+      start: 30
+      end: 56
+    - source: ("kDESede/ECB/PKCS5Padding")
+      style: secondary
+      start: 29
+      end: 57
+    - source: c.init(Cipher.ENCRYPT_MODE, k, iv)
+      style: secondary
+      start: 59
+      end: 93
+    - source: Cipher c = Cipher.getInstance("kDESede/ECB/PKCS5Padding")
+      style: secondary
+      start: 0
+      end: 57
+  ? "javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance(\"DES\").generateKey(); \n"
+  : labels:
+    - source: javax.crypto.KeyGenerator.getInstance("DES")
+      style: primary
+      start: 29
+      end: 73
+    - source: javax.crypto.KeyGenerator
+      style: secondary
+      start: 29
+      end: 54
+    - source: KeyGenerator
+      style: secondary
+      start: 42
+      end: 54
+    - source: .KeyGenerator
+      style: secondary
+      start: 41
+      end: 54
+    - source: javax.crypto.KeyGenerator.getInstance
+      style: secondary
+      start: 29
+      end: 66
+    - source: ("DES")
+      style: secondary
+      start: 66
+      end: 73
+    - source: '"DES"'
+      style: secondary
+      start: 67
+      end: 72
+    - source: '"DES"'
+      style: secondary
+      start: 67
+      end: 72
+    - source: ("DES")
+      style: secondary
+      start: 66
+      end: 73
diff --git a/tests/kotlin/desede-is-deprecated-kotlin-test.yml b/tests/kotlin/desede-is-deprecated-kotlin-test.yml
@@ -0,0 +1,10 @@
+id: desede-is-deprecated-kotlin
+valid:
+  - |
+    Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
+invalid:
+  - |
+     Cipher c = Cipher.getInstance("kDESede/ECB/PKCS5Padding");
+     c.init(Cipher.ENCRYPT_MODE, k, iv);
+  - |
+    javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey(); 
