Skip to content

Add security rules for RSA encryption, XML processing, and AES secrets #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

Add security rules for RSA encryption, XML processing, and AES secrets #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7792faa
xmlinputfactory-dtd-enabled-scala
ESS-ENN Dec 5, 2024
2cb17fd
aes-hardcoded-secret-swift
ESS-ENN Dec 5, 2024
eaa0f21
Removing rsa-padding
ESS-ENN Dec 5, 2024
c799d8f
rsa-padding-set-scala
ESS-ENN Dec 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions rules/scala/security/rsa-padding-set-scala.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
id: rsa-padding-set-scala
language: scala
severity: warning
message: >-
Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may
weaken encryption. This could lead to sensitive data exposure. Instead,
use RSA with `OAEPWithMD5AndMGF1Padding` instead.
note: >-
[CWE-780] Use of RSA Algorithm without OAEP
[REFERENCES]
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
rule:
any:
- pattern: $CIPHER.getInstance($MODE)
constraints:
MODE:
regex: '.*RSA/.*/NoPadding.*'
172 changes: 172 additions & 0 deletions rules/scala/security/xmlinputfactory-dtd-enabled-scala.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,172 @@
id: xmlinputfactory-dtd-enabled-scala
language: scala
severity: warning
message: >-
XMLInputFactory being instantiated without calling the setProperty
functions that are generally used for disabling entity processing. User
controlled data in XML Document builder can result in XML Internal Entity
Processing vulnerabilities like the disclosure of confidential data,
denial of service, Server Side Request Forgery (SSRF), port scanning. Make
sure to disable entity processing functionality.
note: >-
[CWE-611] Improper Restriction of XML External Entity.
[REFERENCES]
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
utils:
match_pattern_ new_XMLInputFactory_newFactory_&_newInstance:
kind: call_expression
all:
- has:
stopBy: end
kind: field_expression
all:
- has:
stopBy: end
kind: identifier
regex: '^XMLInputFactory$'
- has:
stopBy: end
kind: identifier
regex: '^newFactory|newInstance$'
- has:
stopBy: end
kind: arguments
- inside:
stopBy: end
kind: val_definition
all:
- not:
follows:
stopBy: end
kind: call_expression
all:
- has:
stopBy: end
kind: field_expression
all:
- has:
stopBy: end
kind: identifier
- has:
stopBy: end
kind: identifier
regex: '^setProperty$'
- has:
stopBy: end
kind: arguments
all:
- has:
stopBy: neighbor
kind: string
regex: ^"javax.xml.stream.isSupportingExternalEntities"$
- has:
stopBy: neighbor
kind: boolean_literal
regex: '^false$'

- not:
precedes:
stopBy: end
kind: call_expression
all:
- has:
stopBy: end
kind: field_expression
all:
- has:
stopBy: end
kind: identifier
- has:
stopBy: end
kind: identifier
regex: '^setProperty$'
- has:
stopBy: end
kind: arguments
all:
- has:
stopBy: neighbor
kind: string
regex: ^"javax.xml.stream.isSupportingExternalEntities"$
- has:
stopBy: neighbor
kind: boolean_literal
regex: '^false$'

match_pattern_new_XMLInputFactory:
kind: call_expression
all:
- has:
stopBy: neighbor
kind: identifier
regex: '^XMLInputFactory$'
- has:
stopBy: neighbor
kind: arguments
- inside:
stopBy: end
kind: val_definition
all:
- not:
follows:
stopBy: end
kind: call_expression
all:
- has:
stopBy: end
kind: field_expression
all:
- has:
stopBy: end
kind: identifier
- has:
stopBy: end
kind: identifier
regex: '^setProperty$'
- has:
stopBy: end
kind: arguments
all:
- has:
stopBy: neighbor
kind: string
regex: ^"javax.xml.stream.isSupportingExternalEntities"$
- has:
stopBy: neighbor
kind: boolean_literal
regex: '^false$'

- not:
precedes:
stopBy: end
kind: call_expression
all:
- has:
stopBy: end
kind: field_expression
all:
- has:
stopBy: end
kind: identifier
- has:
stopBy: end
kind: identifier
regex: '^setProperty$'
- has:
stopBy: end
kind: arguments
all:
- has:
stopBy: neighbor
kind: string
regex: ^"javax.xml.stream.isSupportingExternalEntities"$
- has:
stopBy: neighbor
kind: boolean_literal
regex: '^false$'

rule:
kind: call_expression
any:
- matches: match_pattern_ new_XMLInputFactory_newFactory_&_newInstance
- matches: match_pattern_new_XMLInputFactory
Loading