Merge pull request #13934 from egregius313/egregius313/add-dashes-to-sha-algorithms

Java: Add dashes to SHA algorithm names in `Encryption.qll`

Author: egregius313

java/ql/lib/change-notes/2023-08-15-add-dashes-to-sha-algorithms.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Modified the `getSecureAlgorithmName` predicate in `Encryption.qll` to also include `SHA-256` and `SHA-512`. Previously only the versions of the names without dashes were considered secure.

java/ql/lib/semmle/code/java/security/Encryption.qll

@@ -270,7 +270,7 @@ string getInsecureAlgorithmRegex() {
 string getASecureAlgorithmName() {
   result =
     [
-      "RSA", "SHA256", "SHA512", "CCM", "GCM", "AES(?![^a-zA-Z](ECB|CBC/PKCS[57]Padding))",
+      "RSA", "SHA-?256", "SHA-?512", "CCM", "GCM", "AES(?![^a-zA-Z](ECB|CBC/PKCS[57]Padding))",
       "Blowfish", "ECIES"
     ]
 }