@@ -8,20 +8,19 @@ private import semmle.code.java.security.Encryption
8
8
private import semmle.code.java.frameworks.Properties
9
9
private import semmle.code.java.dataflow.RangeUtils
10
10
11
- class GetPropertyMethodAccess extends MethodAccess {
11
+ private class GetPropertyMethodAccess extends MethodAccess {
12
12
GetPropertyMethodAccess ( ) { this .getMethod ( ) instanceof PropertiesGetPropertyMethod }
13
13
14
14
private ConfigPair getPair ( ) {
15
15
this .getArgument ( 0 ) .( ConstantStringExpr ) .getStringValue ( ) = result .getNameElement ( ) .getName ( )
16
16
}
17
17
18
- string getValue ( ) {
18
+ string getPropertyValue ( ) {
19
19
result = this .getPair ( ) .getValueElement ( ) .getValue ( ) or
20
20
result = this .getArgument ( 1 ) .( ConstantStringExpr ) .getStringValue ( )
21
21
}
22
22
}
23
23
24
- string getWeakHashingAlgorithm ( DataFlow:: Node node ) {
25
24
/**
26
25
* Get the name of the weak cryptographic algorithm represented by `node`.
27
26
*/
@@ -40,11 +39,9 @@ string getWeakHashingAlgorithmName(DataFlow::Node node) {
40
39
*/
41
40
module InsecureAlgorithmPropertyConfig implements DataFlow:: ConfigSig {
42
41
predicate isSource ( DataFlow:: Node n ) {
43
- exists ( MethodAccess ma , ConfigPair pair |
44
- n .asExpr ( ) = ma and ma .getMethod ( ) instanceof PropertiesGetPropertyMethod
45
- |
46
- ma .getArgument ( 0 ) .( ConstantStringExpr ) .getStringValue ( ) = pair .getNameElement ( ) .getName ( ) and
47
- not pair .getValueElement ( ) .getValue ( ) .regexpMatch ( getSecureAlgorithmRegex ( ) )
42
+ exists ( GetPropertyMethodAccess ma , string algo | n .asExpr ( ) = ma |
43
+ algo = ma .getPropertyValue ( ) and
44
+ not algo .regexpMatch ( getSecureAlgorithmRegex ( ) )
48
45
)
49
46
}
50
47
0 commit comments