Skip to content

Commit b06e053

Browse files
bdrodesbdrodes
committed
Crypto: altering all query IDs in examples to have "examples" in the ID, to make clear the query is not intended for production.
1 parent 1b205d8 commit b06e053

File tree

13 files changed

+32
-29
lines changed

13 files changed

+32
-29
lines changed

‎java/ql/src/experimental/quantum/Examples/WeakBlockModes.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* @name Weak AES Block mode
3-
* @id java/quantum/weak-block-modes
3+
* @id java/quantum/examples/weak-block-modes
44
* @description An AES cipher is in use with an insecure block mode
55
* @kind problem
66
* @problem.severity error

‎java/ql/src/experimental/quantum/Examples/WeakHash.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* @name Weak hashes
33
* @description Finds uses of cryptographic hashing algorithms that are unapproved or otherwise weak.
4-
* @id java/quantum/weak-hash
4+
* @id java/quantum/examples/weak-hash
55
* @kind problem
66
* @problem.severity error
77
* @tags external/cwe/cwe-327

‎java/ql/src/experimental/quantum/Examples/WeakKDFIterationCount.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* @name Weak known key derivation function iteration count
33
* @description Detects key derivation operations with a known weak iteration count.
4-
* @id java/quantum/weak-kdf-iteration-count
4+
* @id java/quantum/examples/weak-kdf-iteration-count
55
* @kind path-problem
66
* @problem.severity error
77
* @tags quantum

‎java/ql/src/experimental/quantum/Examples/WeakKDFKeySize.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* @name Weak known key derivation function output length
33
* @description Detects key derivation operations with a known weak output length
4-
* @id java/quantum/weak-kdf-key-size
4+
* @id java/quantum/examples/weak-kdf-key-size
55
* @kind path-problem
66
* @problem.severity error
77
* @tags quantum

‎java/ql/src/experimental/quantum/Examples/WeakSymmetricCipher.ql‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* @name Weak symmetric ciphers
33
* @description Finds uses of cryptographic symmetric cipher algorithms that are unapproved or otherwise weak.
4-
* @id java/quantum/weak-ciphers
4+
* @id java/quantum/examples/weak-ciphers
55
* @kind problem
66
* @problem.severity error
77
* @tags external/cwe/cwe-327
@@ -16,6 +16,9 @@ import Crypto::KeyOpAlg as KeyOpAlg
1616
from Crypto::KeyOperationAlgorithmNode alg, KeyOpAlg::AlgorithmType algType
1717
where
1818
algType = alg.getAlgorithmType() and
19+
// NOTE: an org may disallow all but AES we could similarly look for
20+
// algType != KeyOpAlg::TSymmetricCipher(KeyOpAlg::AES())
21+
// This is a more comprehensive check than looking for all weak ciphers
1922
(
2023
algType = KeyOpAlg::TSymmetricCipher(KeyOpAlg::DES()) or
2124
algType = KeyOpAlg::TSymmetricCipher(KeyOpAlg::TRIPLE_DES()) or

‎java/ql/src/experimental/quantum/InventorySlices/UnknownOperationAlgorithm.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* @name Operations with unknown algorithm
33
* @description Outputs operations where the algorithm applied is unknown
4-
* @id java/quantum/slices/operation-with-unknown-algorithm
4+
* @id java/quantum/examples/slices/operation-with-unknown-algorithm
55
* @kind problem
66
* @severity info
77
* @tags quantum

‎java/ql/test/experimental/query-tests/quantum/examples/BadMacUse/BadMacUse.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ public void BadDecryptThenMacOnPlaintextVerify(byte[] encryptionKeyBytes, byte[]
5757
SecretKey macKey = new SecretKeySpec(macKeyBytes, "HmacSHA256");
5858
Mac mac = Mac.getInstance("HmacSHA256");
5959
mac.init(macKey);
60-
byte[] computedMac = mac.doFinal(plaintext); // $Alert[java/quantum/bad-mac-order-decrypt-to-mac]
60+
byte[] computedMac = mac.doFinal(plaintext); // $Alert[java/quantum/examples/bad-mac-order-decrypt-to-mac]
6161

6262
if (!MessageDigest.isEqual(receivedMac, computedMac)) {
6363
throw new SecurityException("MAC verification failed");
@@ -77,7 +77,7 @@ public void BadMacOnPlaintext(byte[] encryptionKeyBytes, byte[] macKeyBytes, byt
7777
// Encrypt the plaintext
7878
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
7979
cipher.init(Cipher.ENCRYPT_MODE, encryptionKey, new SecureRandom());
80-
byte[] ciphertext = cipher.doFinal(plaintext); // $Alert[java/quantum/bad-mac-order-encrypt-plaintext-also-in-mac]
80+
byte[] ciphertext = cipher.doFinal(plaintext); // $Alert[java/quantum/examples/bad-mac-order-encrypt-plaintext-also-in-mac]
8181

8282
// Concatenate ciphertext and MAC
8383
byte[] output = new byte[ciphertext.length + computedMac.length];

‎java/ql/test/experimental/query-tests/quantum/examples/InsecureOrUnknownNonceSource/InsecureIVorNonceSource.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ public byte[] encryptWithStaticIvByteArrayWithInitializer(byte[] key, byte[] pla
1717
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
1818

1919
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
20-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]
20+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]
2121
cipher.update(plaintext);
2222
return cipher.doFinal();
2323
}
@@ -30,7 +30,7 @@ public byte[] encryptWithZeroStaticIvByteArray(byte[] key, byte[] plaintext) thr
3030
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
3131

3232
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
33-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/unknown-iv-or-nonce-source]
33+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/unknown-iv-or-nonce-source]
3434
cipher.update(plaintext);
3535
return cipher.doFinal();
3636
}
@@ -46,7 +46,7 @@ public byte[] encryptWithStaticIvByteArray(byte[] key, byte[] plaintext) throws
4646
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
4747

4848
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
49-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]
49+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]
5050
cipher.update(plaintext);
5151
return cipher.doFinal();
5252
}
@@ -62,7 +62,7 @@ public byte[] encryptWithOneOfStaticIvs01(byte[] key, byte[] plaintext) throws E
6262
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
6363

6464
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
65-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]
65+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]
6666
cipher.update(plaintext);
6767
return cipher.doFinal();
6868
}
@@ -78,7 +78,7 @@ public byte[] encryptWithOneOfStaticIvs02(byte[] key, byte[] plaintext) throws E
7878
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
7979

8080
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
81-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]
81+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]
8282
cipher.update(plaintext);
8383
return cipher.doFinal();
8484
}
@@ -94,7 +94,7 @@ public byte[] encryptWithOneOfStaticZeroIvs(byte[] key, byte[] plaintext) throws
9494
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
9595

9696
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
97-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/unknown-iv-or-nonce-source]
97+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/unknown-iv-or-nonce-source]
9898
cipher.update(plaintext);
9999
return cipher.doFinal();
100100
}
@@ -203,7 +203,7 @@ public byte[] encryptWithGeneratedIvByteArrayInsecure(byte[] key, byte[] plainte
203203
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
204204

205205
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
206-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]]
206+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]]
207207
cipher.update(plaintext);
208208
return cipher.doFinal();
209209
}

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownAsymmetricKeySize/InsufficientAsymmetricKeySize.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
public class InsufficientAsymmetricKeySize{
33
public static void test() throws Exception{
44
KeyPairGenerator keyPairGen1 = KeyPairGenerator.getInstance("RSA");
5-
keyPairGen1.initialize(1024); // $Alert[java/quantum/weak-asymmetric-key-gen-size]
5+
keyPairGen1.initialize(1024); // $Alert[java/quantum/examples/weak-asymmetric-key-gen-size]
66
keyPairGen1.generateKeyPair();
77

88
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("DSA");
9-
keyPairGen2.initialize(1024); // $Alert[java/quantum/weak-asymmetric-key-gen-size]
9+
keyPairGen2.initialize(1024); // $Alert[java/quantum/examples/weak-asymmetric-key-gen-size]
1010
keyPairGen2.generateKeyPair();
1111

1212
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("DH");
13-
keyPairGen3.initialize(1024); // $Alert[java/quantum/weak-asymmetric-key-gen-size]
13+
keyPairGen3.initialize(1024); // $Alert[java/quantum/examples/weak-asymmetric-key-gen-size]
1414
keyPairGen3.generateKeyPair();
1515

1616
KeyPairGenerator keyPairGen4 = KeyPairGenerator.getInstance("RSA");

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownHash/WeakHashing.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,33 +12,33 @@ void hashing() throws NoSuchAlgorithmException, IOException {
1212
props.load(new FileInputStream("example.properties"));
1313

1414
// BAD: Using a weak hashing algorithm even with a secure default
15-
MessageDigest bad = MessageDigest.getInstance(props.getProperty("hashAlg1")); // $Alert[java/quantum/weak-hash]
15+
MessageDigest bad = MessageDigest.getInstance(props.getProperty("hashAlg1")); // $Alert[java/quantum/examples/weak-hash]
1616

1717
// BAD: Using a weak hashing algorithm even with a secure default
18-
MessageDigest bad2 = MessageDigest.getInstance(props.getProperty("hashAlg1", "SHA-256")); // $Alert[java/quantum/weak-hash]
18+
MessageDigest bad2 = MessageDigest.getInstance(props.getProperty("hashAlg1", "SHA-256")); // $Alert[java/quantum/examples/weak-hash]
1919

2020
// BAD: Using a strong hashing algorithm but with a weak default
21-
MessageDigest bad3 = MessageDigest.getInstance(props.getProperty("hashAlg2", "MD5")); // $Alert[java/quantum/weak-hash]
21+
MessageDigest bad3 = MessageDigest.getInstance(props.getProperty("hashAlg2", "MD5")); // $Alert[java/quantum/examples/weak-hash]
2222

2323
// BAD: Using a weak hash
24-
MessageDigest bad4 = MessageDigest.getInstance("SHA-1"); // $Alert[java/quantum/weak-hash]
24+
MessageDigest bad4 = MessageDigest.getInstance("SHA-1"); // $Alert[java/quantum/examples/weak-hash]
2525

2626
// BAD: Property does not exist and default (used value) is unknown
27-
MessageDigest bad5 = MessageDigest.getInstance(props.getProperty("non-existent_property", "non-existent_default")); // $Alert[java/quantum/unknown-hash]
27+
MessageDigest bad5 = MessageDigest.getInstance(props.getProperty("non-existent_property", "non-existent_default")); // $Alert[java/quantum/examples/unknown-hash]
2828

2929
java.util.Properties props2 = new java.util.Properties();
3030

3131
props2.load(new FileInputStream("unobserved-file.properties"));
3232

3333
// BAD: "hashAlg2" is not visible in the file loaded for props2, should be an unknown
3434
// FALSE NEGATIVE for unknown hash
35-
MessageDigest bad6 = MessageDigest.getInstance(props2.getProperty("hashAlg2", "SHA-256")); // $Alert[java/quantum/unknown-hash]
35+
MessageDigest bad6 = MessageDigest.getInstance(props2.getProperty("hashAlg2", "SHA-256")); // $Alert[java/quantum/examples/unknown-hash]
3636

3737
// GOOD: Using a strong hashing algorithm
3838
MessageDigest ok = MessageDigest.getInstance(props.getProperty("hashAlg2"));
3939

4040
// BAD?: Property does not exist (considered unknown) and but default is secure
41-
MessageDigest ok2 = MessageDigest.getInstance(props.getProperty("non-existent-property", "SHA-256")); // $Alert[java/quantum/unknown-hash]
41+
MessageDigest ok2 = MessageDigest.getInstance(props.getProperty("non-existent-property", "SHA-256")); // $Alert[java/quantum/examples/unknown-hash]
4242

4343
// GOOD: Using a strong hashing algorithm
4444
MessageDigest ok3 = MessageDigest.getInstance("SHA3-512");

0 commit comments

Comments
 (0)