Skip to content

Commit f7ae4e8

Browse files
Jami Cogswelljcogs33
Jami Cogswell
authored and
jcogs33
committed
apply rasmus' approach
1 parent 1f4bd00 commit f7ae4e8

File tree

1 file changed

+47
-99
lines changed

1 file changed

+47
-99
lines changed

‎java/ql/lib/semmle/code/java/security/InsufficientKeySize.qll‎

Lines changed: 47 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -20,121 +20,69 @@ abstract class InsufficientKeySizeSink extends DataFlow::Node {
2020
private module Asymmetric {
2121
/** Provides models for non-elliptic-curve asymmetric cryptography. */
2222
private module NonEllipticCurve {
23-
private module Rsa {
24-
/** A source for an insufficient key size used in an RSA algorithm. */
25-
private class Source extends InsufficientKeySizeSource {
26-
Source() { this.asExpr().(IntegerLiteral).getIntValue() < getMinKeySize() }
27-
28-
override predicate hasState(DataFlow::FlowState state) {
29-
state = getMinKeySize().toString()
30-
}
31-
}
32-
33-
/** A sink for an insufficient key size used in an RSA algorithm. */
34-
private class Sink extends InsufficientKeySizeSink {
35-
Sink() {
36-
exists(KeyPairGenInit kpgInit, KeyPairGen kpg |
37-
kpg.getAlgoName() = "RSA" and
38-
DataFlow::localExprFlow(kpg, kpgInit.getQualifier()) and
39-
this.asExpr() = kpgInit.getKeySizeArg()
40-
)
41-
or
42-
exists(Spec spec | this.asExpr() = spec.getKeySizeArg())
43-
}
44-
45-
override predicate hasState(DataFlow::FlowState state) {
46-
state = getMinKeySize().toString()
47-
}
48-
}
49-
50-
/** Returns the minimum recommended key size for an RSA algorithm. */
51-
private int getMinKeySize() { result = minSecureKeySizeRsa() }
23+
/** A source for an insufficient key size used in an RSA, DSA, and DH algorithms. */
24+
private class Source extends InsufficientKeySizeSource {
25+
string algoName;
5226

53-
/** An instance of an RSA algorithm specification. */
54-
private class Spec extends ClassInstanceExpr {
55-
Spec() { this.getConstructedType() instanceof RsaKeyGenParameterSpec }
27+
Source() { this.asExpr().(IntegerLiteral).getIntValue() < getMinKeySize(algoName) }
5628

57-
/** Gets the `keysize` argument of this instance. */
58-
Argument getKeySizeArg() { result = this.getArgument(0) }
29+
override predicate hasState(DataFlow::FlowState state) {
30+
state = getMinKeySize(algoName).toString()
5931
}
6032
}
6133

62-
private module Dsa {
63-
/** A source for an insufficient key size used a DSA algorithm. */
64-
private class Source extends InsufficientKeySizeSource {
65-
Source() { this.asExpr().(IntegerLiteral).getIntValue() < getMinKeySize() }
34+
/** A sink for an insufficient key size used in an RSA, DSA, and DH algorithms. */
35+
private class Sink extends InsufficientKeySizeSink {
36+
string algoName;
6637

67-
override predicate hasState(DataFlow::FlowState state) {
68-
state = getMinKeySize().toString()
69-
}
38+
Sink() {
39+
exists(KeyPairGenInit kpgInit, KeyPairGen kpg |
40+
algoName in ["RSA", "DSA", "DH"] and
41+
kpg.getAlgoName().matches(algoName) and
42+
DataFlow::localExprFlow(kpg, kpgInit.getQualifier()) and
43+
this.asExpr() = kpgInit.getKeySizeArg()
44+
)
45+
or
46+
exists(Spec spec | this.asExpr() = spec.getKeySizeArg() and algoName = spec.getAlgoName())
7047
}
7148

72-
/** A sink for an insufficient key size used in a DSA algorithm. */
73-
private class Sink extends InsufficientKeySizeSink {
74-
Sink() {
75-
exists(KeyPairGenInit kpgInit, KeyPairGen kpg |
76-
kpg.getAlgoName() = "DSA" and
77-
DataFlow::localExprFlow(kpg, kpgInit.getQualifier()) and
78-
this.asExpr() = kpgInit.getKeySizeArg()
79-
)
80-
or
81-
exists(Spec spec | this.asExpr() = spec.getKeySizeArg())
82-
}
83-
84-
override predicate hasState(DataFlow::FlowState state) {
85-
state = getMinKeySize().toString()
86-
}
87-
}
88-
89-
/** Returns the minimum recommended key size for a DSA algorithm. */
90-
private int getMinKeySize() { result = minSecureKeySizeDsa() }
91-
92-
/** An instance of a DSA algorithm specification. */
93-
private class Spec extends ClassInstanceExpr {
94-
Spec() { this.getConstructedType() instanceof DsaGenParameterSpec }
95-
96-
/** Gets the `keysize` argument of this instance. */
97-
Argument getKeySizeArg() { result = this.getArgument(0) }
49+
override predicate hasState(DataFlow::FlowState state) {
50+
state = getMinKeySize(algoName).toString()
9851
}
9952
}
10053

101-
private module Dh {
102-
/** A source for an insufficient key size used in a DH algorithm. */
103-
private class Source extends InsufficientKeySizeSource {
104-
Source() { this.asExpr().(IntegerLiteral).getIntValue() < getMinKeySize() }
54+
/** Returns the minimum recommended key size for RSA, DSA, and DH algorithms. */
55+
private int getMinKeySize(string algoName) {
56+
algoName = "RSA" and
57+
result = minSecureKeySizeRsa()
58+
or
59+
algoName = "DSA" and
60+
result = minSecureKeySizeDsa()
61+
or
62+
algoName = "DH" and
63+
result = minSecureKeySizeDh()
64+
}
10565

106-
override predicate hasState(DataFlow::FlowState state) {
107-
state = getMinKeySize().toString()
108-
}
109-
}
66+
/** An instance of an RSA, DSA, or DH algorithm specification. */
67+
private class Spec extends ClassInstanceExpr {
68+
string algoName;
11069

111-
/** A sink for an insufficient key size used in a DH algorithm. */
112-
private class Sink extends InsufficientKeySizeSink {
113-
Sink() {
114-
exists(KeyPairGenInit kpgInit, KeyPairGen kpg |
115-
kpg.getAlgoName() = "DH" and
116-
DataFlow::localExprFlow(kpg, kpgInit.getQualifier()) and
117-
this.asExpr() = kpgInit.getKeySizeArg()
118-
)
119-
or
120-
exists(Spec spec | this.asExpr() = spec.getKeySizeArg())
121-
}
122-
123-
override predicate hasState(DataFlow::FlowState state) {
124-
state = getMinKeySize().toString()
125-
}
70+
Spec() {
71+
this.getConstructedType() instanceof RsaKeyGenParameterSpec and
72+
algoName = "RSA"
73+
or
74+
this.getConstructedType() instanceof DsaGenParameterSpec and
75+
algoName = "DSA"
76+
or
77+
this.getConstructedType() instanceof DhGenParameterSpec and
78+
algoName = "DH"
12679
}
12780

128-
/** Returns the minimum recommended key size for a DH algorithm. */
129-
private int getMinKeySize() { result = minSecureKeySizeDh() }
130-
131-
/** An instance of an RSA, DSA, or DH algorithm specification. */
132-
private class Spec extends ClassInstanceExpr {
133-
Spec() { this.getConstructedType() instanceof DhGenParameterSpec }
81+
/** Gets the `keysize` argument of this instance. */
82+
Argument getKeySizeArg() { result = this.getArgument(0) }
13483

135-
/** Gets the `keysize` argument of this instance. */
136-
Argument getKeySizeArg() { result = this.getArgument(0) }
137-
}
84+
/** Gets the algorithm name of this spec. */
85+
string getAlgoName() { result = algoName }
13886
}
13987
}
14088

0 commit comments

Comments
 (0)