|
2 | 2 | * Provides classes for modeling cryptographic libraries.
|
3 | 3 | */
|
4 | 4 |
|
5 |
| -/* |
6 |
| - * The following information is copied from `/semmlecode-javascript-queries/semmle/javascript/frameworks/CryptoLibraries.qll` |
7 |
| - * which should be considered the definitive version (as of Feb 2018) |
8 |
| - */ |
9 |
| - |
10 | 5 | /**
|
11 | 6 | * Names of cryptographic algorithms, separated into strong and weak variants.
|
12 | 7 | *
|
13 | 8 | * The names are normalized: upper-case, no spaces, dashes or underscores.
|
14 | 9 | *
|
15 | 10 | * The names are inspired by the names used in real world crypto libraries.
|
| 11 | + * |
| 12 | + * The classification into strong and weak are based on Wikipedia, OWASP and google (2017). |
16 | 13 | */
|
17 | 14 | private module AlgorithmNames {
|
18 | 15 | predicate isStrongHashingAlgorithm(string name) {
|
@@ -81,14 +78,6 @@ private module AlgorithmNames {
|
81 | 78 | }
|
82 | 79 |
|
83 | 80 | predicate isWeakPasswordHashingAlgorithm(string name) { none() }
|
84 |
| - |
85 |
| - /** |
86 |
| - * Normalizes `name`: upper-case, no spaces, dashes or underscores. |
87 |
| - * |
88 |
| - * All names of this module are in this normalized form. |
89 |
| - */ |
90 |
| - bindingset[name] |
91 |
| - string normalizeName(string name) { result = name.toUpperCase().regexpReplaceAll("[-_ ]", "") } |
92 | 81 | }
|
93 | 82 |
|
94 | 83 | private import AlgorithmNames
|
@@ -121,10 +110,19 @@ abstract class CryptographicAlgorithm extends TCryptographicAlgorithm {
|
121 | 110 | string toString() { result = getName() }
|
122 | 111 |
|
123 | 112 | /**
|
124 |
| - * Gets the name of the algorithm. |
| 113 | + * Gets the name of this algorithm. |
125 | 114 | */
|
126 | 115 | abstract string getName();
|
127 | 116 |
|
| 117 | + /** |
| 118 | + * Holds if the name of this algorithm matches `name` modulo case, |
| 119 | + * white space, dashes and underscores. |
| 120 | + */ |
| 121 | + bindingset[name] |
| 122 | + predicate matchesName(string name) { |
| 123 | + name.toUpperCase().regexpReplaceAll("[-_ ]", "") = getName() |
| 124 | + } |
| 125 | + |
128 | 126 | /**
|
129 | 127 | * Holds if this algorithm is weak.
|
130 | 128 | */
|
|
0 commit comments