Skip to content

Commit dd223ed

Browse files
committed
feat: add rsa/ecb/... variants to the list of secure algorithms
1 parent ad2eacf commit dd223ed

File tree

2 files changed

+3
-1
lines changed

2 files changed

+3
-1
lines changed

java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ private class ShortStringLiteral extends StringLiteral {
1515
class BrokenAlgoLiteral extends ShortStringLiteral {
1616
BrokenAlgoLiteral() {
1717
this.getValue().regexpMatch(getInsecureAlgorithmRegex()) and
18+
not this.getValue().regexpMatch(getASecureAlgorithmName()) and
1819
// Exclude German and French sentences.
1920
not this.getValue().regexpMatch(".*\\p{IsLowercase} des \\p{IsLetter}.*")
2021
}

java/ql/lib/semmle/code/java/security/Encryption.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,8 @@ string getASecureAlgorithmName() {
250250
result =
251251
[
252252
"RSA", "SHA-?256", "SHA-?512", "CCM", "GCM", "AES(?![^a-zA-Z](ECB|CBC/PKCS[57]Padding))",
253-
"Blowfish", "ECIES"
253+
"Blowfish", "ECIES", "RSA/ECB/OAEPWithSHA-1AndMGF1Padding", "RSA/ECB/PKCS1Padding",
254+
"RSA/ECB/OAEPWithSHA-256AndMGF1Padding"
254255
]
255256
}
256257

0 commit comments

Comments
 (0)