Skip to content

Commit d084261

Browse files
committed
Python: Ignore weak key-sizes from test-code in weak-crypto-key
From looking at old results on LGTM.com, this was quite common (and those alerts doesn't really provide value).
1 parent bfc8ead commit d084261

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

python/ql/src/Security/CWE-326/WeakCryptoKey.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,13 @@
1212
import python
1313
import semmle.python.Concepts
1414
import semmle.python.dataflow.new.DataFlow
15+
import semmle.python.filters.Tests
1516

1617
from Cryptography::PublicKey::KeyGeneration keyGen, int keySize, DataFlow::Node origin
1718
where
1819
keySize = keyGen.getKeySizeWithOrigin(origin) and
19-
keySize < keyGen.minimumSecureKeySize()
20+
keySize < keyGen.minimumSecureKeySize() and
21+
not origin.getScope().getScope*() instanceof TestScope
2022
select keyGen,
2123
"Creation of an " + keyGen.getName() + " key uses $@ bits, which is below " +
2224
keyGen.minimumSecureKeySize() + " and considered breakable.", origin, keySize.toString()
Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
| test_example.py:7:5:7:22 | ControlFlowNode for Attribute() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | test_example.py:7:18:7:21 | ControlFlowNode for IntegerLiteral | 1024 |
21
| weak_crypto.py:68:1:68:21 | ControlFlowNode for dsa_gen_key() | Creation of an DSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:16:12:16:15 | ControlFlowNode for IntegerLiteral | 1024 |
32
| weak_crypto.py:69:1:69:19 | ControlFlowNode for ec_gen_key() | Creation of an ECC key uses $@ bits, which is below 224 and considered breakable. | weak_crypto.py:22:11:22:24 | ControlFlowNode for Attribute() | 163 |
43
| weak_crypto.py:70:1:70:28 | ControlFlowNode for rsa_gen_key() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
@@ -8,4 +7,3 @@
87
| weak_crypto.py:76:1:76:22 | ControlFlowNode for Attribute() | Creation of an DSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:16:12:16:15 | ControlFlowNode for IntegerLiteral | 1024 |
98
| weak_crypto.py:77:1:77:22 | ControlFlowNode for Attribute() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
109
| weak_crypto.py:84:12:84:29 | ControlFlowNode for Attribute() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
11-
| weak_crypto.py:95:12:95:29 | ControlFlowNode for Attribute() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | test_example.py:9:23:9:26 | ControlFlowNode for IntegerLiteral | 1024 |

0 commit comments

Comments
 (0)