Skip to content

Commit 5e0f0c0

Browse files
redsun82redsun82
committed
Merge branch 'main' into redsun82/cargo-upgrade-2
2 parents 680b4ab + 963e028 commit 5e0f0c0

File tree

10 files changed

+125
-42
lines changed

10 files changed

+125
-42
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -756,9 +756,9 @@ private predicate modeledFlowBarrier(Node n) {
756756
partialFlowFunc = call.getStaticCallTarget() and
757757
not partialFlowFunc.isPartialWrite(output)
758758
|
759-
call.getStaticCallTarget().(DataFlow::DataFlowFunction).hasDataFlow(_, output)
759+
partialFlowFunc.(DataFlow::DataFlowFunction).hasDataFlow(_, output)
760760
or
761-
call.getStaticCallTarget().(Taint::TaintFunction).hasTaintFlow(_, output)
761+
partialFlowFunc.(Taint::TaintFunction).hasTaintFlow(_, output)
762762
)
763763
or
764764
exists(Operand operand, Instruction instr, Node n0, int indirectionIndex |

‎cpp/ql/lib/semmle/code/cpp/models/interfaces/FormattingFunction.qll‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,16 @@ abstract class FormattingFunction extends ArrayFunction, TaintFunction {
170170
output.isParameterDeref(this.getOutputParameterIndex(_))
171171
)
172172
}
173+
174+
final override predicate isPartialWrite(FunctionOutput output) {
175+
exists(int outputParameterIndex |
176+
output.isParameterDeref(outputParameterIndex) and
177+
// We require the output to be a stream since that definitely means that
178+
// it's a partial write. If it's not a stream then it will most likely
179+
// fill the whole buffer.
180+
outputParameterIndex = this.getOutputParameterIndex(true)
181+
)
182+
}
173183
}
174184

175185
/**

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7767,6 +7767,10 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
77677767
| taint.cpp:830:20:830:34 | call to indirect_source | taint.cpp:832:23:832:24 | in | |
77687768
| taint.cpp:831:15:831:17 | out | taint.cpp:832:18:832:20 | out | |
77697769
| taint.cpp:831:15:831:17 | out | taint.cpp:833:8:833:10 | out | |
7770+
| taint.cpp:841:21:841:35 | call to indirect_source | taint.cpp:842:11:842:12 | fp | |
7771+
| taint.cpp:841:21:841:35 | call to indirect_source | taint.cpp:843:16:843:17 | fp | |
7772+
| taint.cpp:842:11:842:12 | ref arg fp | taint.cpp:843:16:843:17 | fp | |
7773+
| taint.cpp:842:15:842:16 | | taint.cpp:842:11:842:12 | ref arg fp | TAINT |
77707774
| thread.cpp:10:27:10:27 | s | thread.cpp:10:27:10:27 | s | |
77717775
| thread.cpp:10:27:10:27 | s | thread.cpp:11:8:11:8 | s | |
77727776
| thread.cpp:14:26:14:26 | s | thread.cpp:15:8:15:8 | s | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -831,4 +831,15 @@ void test_write_to_const_ptr_ptr() {
831831
const char* out;
832832
take_const_ptr(out, in);
833833
sink(out); // $ SPURIOUS: ast
834+
}
835+
836+
void indirect_sink(FILE *fp);
837+
int fprintf(FILE *fp, const char *format, ...);
838+
839+
int f7(void)
840+
{
841+
FILE* fp = (FILE*)indirect_source();
842+
fprintf(fp, "");
843+
indirect_sink(fp); // $ ir MISSING: ast
844+
return 0;
834845
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,11 @@ module IRTest {
117117
call.getTarget().getName() = "sink" and
118118
[sink.asExpr(), sink.asIndirectExpr()] = call.getAnArgument()
119119
)
120+
or
121+
exists(FunctionCall call |
122+
call.getTarget().getName() = "indirect_sink" and
123+
sink.asIndirectExpr() = call.getAnArgument()
124+
)
120125
}
121126

122127
predicate isBarrier(DataFlow::Node barrier) {

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17670,6 +17670,55 @@ signatureMatches
1767017670
| taint.cpp:822:6:822:19 | take_const_ptr | (unsigned long *,const char *) | | set_cert_ex | 1 |
1767117671
| taint.cpp:822:6:822:19 | take_const_ptr | (unsigned long *,const char *) | | set_name_ex | 1 |
1767217672
| taint.cpp:822:6:822:19 | take_const_ptr | (uv_pipe_t *,const char *) | | uv_pipe_bind | 1 |
17673+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_default_uflow | 0 |
17674+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_feof | 0 |
17675+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_ferror | 0 |
17676+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_file_close_mmap | 0 |
17677+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_file_underflow_mmap | 0 |
17678+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_ftell | 0 |
17679+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_getc | 0 |
17680+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_getwc | 0 |
17681+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_new_file_underflow | 0 |
17682+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_peekc_locked | 0 |
17683+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_str_count | 0 |
17684+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_str_underflow | 0 |
17685+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_sungetc | 0 |
17686+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_sungetwc | 0 |
17687+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wdefault_uflow | 0 |
17688+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wfile_underflow | 0 |
17689+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wfile_underflow_mmap | 0 |
17690+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wstr_count | 0 |
17691+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wstr_underflow | 0 |
17692+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fbufsize | 0 |
17693+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __feof_unlocked | 0 |
17694+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __ferror_unlocked | 0 |
17695+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fileno | 0 |
17696+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __flbf | 0 |
17697+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fopen_maybe_mmap | 0 |
17698+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fpending | 0 |
17699+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __ftello | 0 |
17700+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fwriting | 0 |
17701+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __getc_unlocked | 0 |
17702+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __getwc_unlocked | 0 |
17703+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __uflow | 0 |
17704+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __underflow | 0 |
17705+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __wuflow | 0 |
17706+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __wunderflow | 0 |
17707+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | feof_unlocked | 0 |
17708+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | ferror_unlocked | 0 |
17709+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetc_unlocked | 0 |
17710+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetgrent | 0 |
17711+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetpwent | 0 |
17712+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetsgent | 0 |
17713+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetspent | 0 |
17714+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | getc_unlocked | 0 |
17715+
| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | getmntent | 0 |
17716+
| taint.cpp:837:5:837:11 | fprintf | (CURLSH *,CURLSHoption,...) | | curl_share_setopt | 2 |
17717+
| taint.cpp:837:5:837:11 | fprintf | (Jim_Interp *,const char *,...) | | Jim_SetResultFormatted | 1 |
17718+
| taint.cpp:837:5:837:11 | fprintf | (Jim_Interp *,const char *,...) | | Jim_SetResultFormatted | 2 |
17719+
| taint.cpp:837:5:837:11 | fprintf | (char **,const char *,...) | | ___asprintf | 1 |
17720+
| taint.cpp:837:5:837:11 | fprintf | (char **,const char *,...) | | ___asprintf | 2 |
17721+
| taint.cpp:837:5:837:11 | fprintf | (curl_httppost **,curl_httppost **,...) | | curl_formadd | 2 |
1767317722
| thread.cpp:4:6:4:9 | sink | (int) | | ASN1_STRING_type_new | 0 |
1767417723
| thread.cpp:4:6:4:9 | sink | (int) | | ASN1_tag2bit | 0 |
1767517724
| thread.cpp:4:6:4:9 | sink | (int) | | ASN1_tag2str | 0 |
@@ -47191,6 +47240,10 @@ getParameterTypeName
4719147240
| taint.cpp:817:6:817:27 | write_to_const_ptr_ptr | 1 | const char ** |
4719247241
| taint.cpp:822:6:822:19 | take_const_ptr | 0 | const char * |
4719347242
| taint.cpp:822:6:822:19 | take_const_ptr | 1 | const char * |
47243+
| taint.cpp:836:6:836:18 | indirect_sink | 0 | FILE * |
47244+
| taint.cpp:837:5:837:11 | fprintf | 0 | FILE * |
47245+
| taint.cpp:837:5:837:11 | fprintf | 1 | const char * |
47246+
| taint.cpp:837:5:837:11 | fprintf | 2 | ... |
4719447247
| thread.cpp:4:6:4:9 | sink | 0 | int |
4719547248
| thread.cpp:6:8:6:8 | operator= | 0 | S && |
4719647249
| thread.cpp:6:8:6:8 | operator= | 0 | const S & |

‎rust/ql/lib/codeql/rust/frameworks/rustcrypto/RustCrypto.qll‎

Lines changed: 14 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
private import rust
66
private import codeql.rust.Concepts
77
private import codeql.rust.dataflow.DataFlow
8+
private import codeql.rust.internal.TypeInference
9+
private import codeql.rust.internal.Type
810

911
bindingset[algorithmName]
1012
private string simplifyAlgorithmName(string algorithmName) {
@@ -21,28 +23,20 @@ class StreamCipherInit extends Cryptography::CryptographicOperation::Range {
2123

2224
StreamCipherInit() {
2325
// a call to `cipher::KeyInit::new`, `cipher::KeyInit::new_from_slice`,
24-
// `cipher::KeyIvInit::new`, `cipher::KeyIvInit::new_from_slices` or `rc2::Rc2::new_with_eff_key_len`.
25-
exists(PathExpr p, string rawAlgorithmName |
26-
this.asExpr().getExpr().(CallExpr).getFunction() = p and
27-
p.getResolvedCrateOrigin().matches("%/RustCrypto%") and
28-
p.getPath().getText() = ["new", "new_from_slice", "new_from_slices", "new_with_eff_key_len"] and
29-
(
30-
rawAlgorithmName = p.getPath().getQualifier().getText() or
26+
// `cipher::KeyIvInit::new`, `cipher::KeyIvInit::new_from_slices`, `rc2::Rc2::new_with_eff_key_len` or similar.
27+
exists(CallExprBase ce, string rawAlgorithmName |
28+
ce = this.asExpr().getExpr() and
29+
ce.getStaticTarget().getName().getText() =
30+
["new", "new_from_slice", "new_with_eff_key_len", "new_from_slices"] and
31+
// extract the algorithm name from the type of `ce` or its receiver.
32+
exists(Type t, TypePath tp |
33+
t = inferType([ce, ce.(MethodCallExpr).getReceiver()], tp) and
3134
rawAlgorithmName =
32-
p.getPath()
33-
.getQualifier()
34-
.getSegment()
35-
.getGenericArgList()
36-
.getGenericArg(0)
37-
.(TypeArg)
38-
.getTypeRepr()
39-
.(PathTypeRepr)
40-
.getPath()
41-
.getSegment()
42-
.getIdentifier()
43-
.getText()
35+
t.(StructType).asItemNode().(Addressable).getCanonicalPath().splitAt("::")
4436
) and
45-
algorithmName = simplifyAlgorithmName(rawAlgorithmName)
37+
algorithmName = simplifyAlgorithmName(rawAlgorithmName) and
38+
// only match a known cryptographic algorithm
39+
any(Cryptography::CryptographicAlgorithm alg).matchesName(algorithmName)
4640
)
4741
}
4842

‎rust/ql/test/query-tests/security/CWE-327/BrokenCryptoAlgorithm.expected‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,22 @@
22
| test_cipher.rs:23:27:23:60 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:23:27:23:60 | ...::new_from_slice(...) | The cryptographic algorithm RC4 |
33
| test_cipher.rs:26:27:26:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:26:27:26:48 | ...::new(...) | The cryptographic algorithm RC4 |
44
| test_cipher.rs:29:27:29:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:29:27:29:48 | ...::new(...) | The cryptographic algorithm RC4 |
5-
| test_cipher.rs:59:23:59:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:59:23:59:42 | ...::new(...) | The cryptographic algorithm DES |
6-
| test_cipher.rs:63:23:63:47 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:63:23:63:47 | ...::new(...) | The cryptographic algorithm DES |
7-
| test_cipher.rs:67:23:67:46 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:67:23:67:46 | ...::new_from_slice(...) | The cryptographic algorithm DES |
8-
| test_cipher.rs:71:23:71:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:71:23:71:42 | ...::new(...) | The cryptographic algorithm DES |
9-
| test_cipher.rs:75:27:75:46 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:75:27:75:46 | ...::new(...) | The cryptographic algorithm DES |
10-
| test_cipher.rs:80:24:80:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:80:24:80:48 | ...::new(...) | The cryptographic algorithm 3DES |
5+
| test_cipher.rs:59:29:59:45 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:59:29:59:45 | ...::new(...) | The cryptographic algorithm DES |
6+
| test_cipher.rs:63:23:63:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:63:23:63:42 | ...::new(...) | The cryptographic algorithm DES |
7+
| test_cipher.rs:67:23:67:47 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:67:23:67:47 | ...::new(...) | The cryptographic algorithm DES |
8+
| test_cipher.rs:71:23:71:46 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:71:23:71:46 | ...::new_from_slice(...) | The cryptographic algorithm DES |
9+
| test_cipher.rs:75:23:75:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:75:23:75:42 | ...::new(...) | The cryptographic algorithm DES |
10+
| test_cipher.rs:79:27:79:46 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:79:27:79:46 | ...::new(...) | The cryptographic algorithm DES |
1111
| test_cipher.rs:84:24:84:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:84:24:84:48 | ...::new(...) | The cryptographic algorithm 3DES |
12+
| test_cipher.rs:84:24:84:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:84:24:84:48 | ...::new(...) | The cryptographic algorithm DES |
1213
| test_cipher.rs:88:24:88:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:88:24:88:48 | ...::new(...) | The cryptographic algorithm 3DES |
13-
| test_cipher.rs:92:24:92:52 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:92:24:92:52 | ...::new_from_slice(...) | The cryptographic algorithm 3DES |
14-
| test_cipher.rs:97:23:97:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:97:23:97:42 | ...::new(...) | The cryptographic algorithm RC2 |
15-
| test_cipher.rs:101:23:101:46 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:101:23:101:46 | ...::new_from_slice(...) | The cryptographic algorithm RC2 |
16-
| test_cipher.rs:105:23:105:56 | ...::new_with_eff_key_len(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:105:23:105:56 | ...::new_with_eff_key_len(...) | The cryptographic algorithm RC2 |
17-
| test_cipher.rs:110:23:110:50 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:110:23:110:50 | ...::new(...) | The cryptographic algorithm RC5 |
18-
| test_cipher.rs:114:23:114:55 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:114:23:114:55 | ...::new_from_slice(...) | The cryptographic algorithm RC5 |
19-
| test_cipher.rs:132:23:132:76 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:132:23:132:76 | ...::new(...) | The cryptographic algorithm DES |
20-
| test_cipher.rs:138:23:138:76 | ...::new_from_slices(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:138:23:138:76 | ...::new_from_slices(...) | The cryptographic algorithm DES |
21-
| test_cipher.rs:141:23:141:76 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:141:23:141:76 | ...::new(...) | The cryptographic algorithm DES |
14+
| test_cipher.rs:88:24:88:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:88:24:88:48 | ...::new(...) | The cryptographic algorithm DES |
15+
| test_cipher.rs:92:24:92:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:92:24:92:48 | ...::new(...) | The cryptographic algorithm 3DES |
16+
| test_cipher.rs:92:24:92:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:92:24:92:48 | ...::new(...) | The cryptographic algorithm DES |
17+
| test_cipher.rs:96:24:96:52 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:96:24:96:52 | ...::new_from_slice(...) | The cryptographic algorithm 3DES |
18+
| test_cipher.rs:96:24:96:52 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:96:24:96:52 | ...::new_from_slice(...) | The cryptographic algorithm DES |
19+
| test_cipher.rs:101:23:101:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:101:23:101:42 | ...::new(...) | The cryptographic algorithm RC2 |
20+
| test_cipher.rs:105:23:105:46 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:105:23:105:46 | ...::new_from_slice(...) | The cryptographic algorithm RC2 |
21+
| test_cipher.rs:109:23:109:56 | ...::new_with_eff_key_len(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:109:23:109:56 | ...::new_with_eff_key_len(...) | The cryptographic algorithm RC2 |
22+
| test_cipher.rs:114:23:114:50 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:114:23:114:50 | ...::new(...) | The cryptographic algorithm RC5 |
23+
| test_cipher.rs:118:23:118:55 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:118:23:118:55 | ...::new_from_slice(...) | The cryptographic algorithm RC5 |

‎rust/ql/test/query-tests/security/CWE-327/CONSISTENCY/PathResolutionConsistency.expected‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ multipleCallTargets
44
| test_cipher.rs:29:27:29:48 | ...::new(...) |
55
| test_cipher.rs:36:30:36:59 | ...::new(...) |
66
| test_cipher.rs:39:30:39:63 | ...::new(...) |
7-
| test_cipher.rs:110:23:110:50 | ...::new(...) |
7+
| test_cipher.rs:114:23:114:50 | ...::new(...) |

‎rust/ql/test/query-tests/security/CWE-327/test_cipher.rs‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ fn test_stream_cipher(
4242

4343
fn test_block_cipher(
4444
key: &[u8], key128: &[u8;16], key192: &[u8;24], key256: &[u8;32],
45-
data: &mut [u8], input: &[u8], block128: &mut [u8;16]
45+
data: &mut [u8], input: &[u8], block128: &mut [u8;16], des_key : &cipher::Key<Des>
4646
) {
4747
// aes
4848
let aes_cipher1 = Aes128::new(key128.into());
@@ -56,6 +56,10 @@ fn test_block_cipher(
5656
aes_cipher3.decrypt_block(block128.into());
5757

5858
// des (broken)
59+
let des_cipher0 : Des = Des::new(des_key); // $ Alert[rust/weak-cryptographic-algorithm]
60+
des_cipher0.encrypt_block(data.into());
61+
des_cipher0.decrypt_block(data.into());
62+
5963
let des_cipher1 = Des::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
6064
des_cipher1.encrypt_block(data.into());
6165
des_cipher1.decrypt_block(data.into());
@@ -129,15 +133,15 @@ fn test_cbc(
129133
_ = aes_cipher1.encrypt_padded_mut::<aes::cipher::block_padding::Pkcs7>(data, data_len).unwrap();
130134

131135
// des (broken)
132-
let des_cipher1 = cbc::Encryptor::<des::Des>::new(key.into(), iv.into()); // $ Alert[rust/weak-cryptographic-algorithm]
136+
let des_cipher1 = cbc::Encryptor::<des::Des>::new(key.into(), iv.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
133137
_ = des_cipher1.encrypt_padded_mut::<des::cipher::block_padding::Pkcs7>(data, data_len).unwrap();
134138

135139
let des_cipher2 = MyDesEncryptor::new(key.into(), iv.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
136140
_ = des_cipher2.encrypt_padded_mut::<des::cipher::block_padding::Pkcs7>(data, data_len).unwrap();
137141

138-
let des_cipher3 = cbc::Encryptor::<des::Des>::new_from_slices(&key, &iv).unwrap(); // $ Alert[rust/weak-cryptographic-algorithm]
142+
let des_cipher3 = cbc::Encryptor::<des::Des>::new_from_slices(&key, &iv).unwrap(); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
139143
_ = des_cipher3.encrypt_padded_mut::<des::cipher::block_padding::Pkcs7>(data, data_len).unwrap();
140144

141-
let des_cipher4 = cbc::Encryptor::<des::Des>::new(key.into(), iv.into()); // $ Alert[rust/weak-cryptographic-algorithm]
145+
let des_cipher4 = cbc::Encryptor::<des::Des>::new(key.into(), iv.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
142146
_ = des_cipher4.encrypt_padded_b2b_mut::<des::cipher::block_padding::Pkcs7>(input, data).unwrap();
143147
}

0 commit comments

Comments
 (0)