[DIFF-INFORMED] Java: MaybeBrokenCryptoAlgorithm

d10c · d10c · commit bc0b3835955c · 2025-07-17T19:02:00.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql#L25
diff --git a/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll b/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll
@@ -77,6 +77,12 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {
     objectToString(n.asExpr()) or
     n.getType().getErasure() instanceof TypeObject
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSinkLocation(DataFlow::Node sink) {
+    exists(CryptoAlgoSpec c | result = c.getLocation() | sink.asExpr() = c.getAlgoSpec())
+  }
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -77,6 +77,12 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {`
`77`	`77`	`objectToString(n.asExpr()) or`
`78`	`78`	`n.getType().getErasure() instanceof TypeObject`
`79`	`79`	`}`
	`80`	`+`
	`81`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
	`82`	`+`
	`83`	`+ Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`84`	`+ exists(CryptoAlgoSpec c \| result = c.getLocation() \| sink.asExpr() = c.getAlgoSpec())`
	`85`	`+ }`
`80`	`86`	`}`
`81`	`87`
`82`	`88`	`/**`