Skip to content

Commit 6d7ac8d

Browse files
bdrodesropwareJB
bdrodes
authored and
ropwareJB
committed
Adding example alerts
1 parent 4c9cc5a commit 6d7ac8d

File tree

6 files changed

+184
-0
lines changed

6 files changed

+184
-0
lines changed

‎cpp/ql/src/experimental/crypto/example_alerts/UnknownAsymmetricKeyGen.ql

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/**
2+
* @name Unknown key generation key size
3+
* @description
4+
* @id cpp/unknown-asymmetric-key-gen-size
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags security
9+
* external/cwe/cwe-326
10+
*/
11+
import cpp
12+
13+
import experimental.crypto.Concepts
14+
15+
from AsymmetricKeyGeneration op, AsymmetricAlgorithm alg
16+
where
17+
alg = op.getAlgorithm() and
18+
not alg instanceof EllipticCurveAlgorithm and
19+
not exists(op.getKeySizeInBits(alg))
20+
select op, "Use of unknown asymmetric key size for algorithm $@", alg, alg.getName().toString()
21+

‎cpp/ql/src/experimental/crypto/example_alerts/WeakAsymmetricKeyGen.ql

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* @name Weak asymmetric key generation key size (< 2048 bits)
3+
* @description
4+
* @id cpp/weak-asymmetric-key-gen-size
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags security
9+
* external/cwe/cwe-326
10+
*/
11+
import cpp
12+
13+
import experimental.crypto.Concepts
14+
15+
from AsymmetricKeyGeneration op, AsymmetricAlgorithm alg, Expr configSrc, int size
16+
where
17+
alg = op.getAlgorithm() and
18+
not alg instanceof EllipticCurveAlgorithm and
19+
configSrc = op.getKeyConfigurationSource(alg) and
20+
size = configSrc.getValue().toInt() and
21+
size < 2048
22+
select op, "Use of weak asymmetric key size (in bits) " + size + " configured at $@ for algorithm $@", configSrc, configSrc.toString(), alg, alg.getName().toString()

‎cpp/ql/src/experimental/crypto/example_alerts/WeakBlockMode.ql

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/**
2+
* @name Weak block mode
3+
* @description Finds uses of symmetric encryption block modes that are weak, obsolete, or otherwise unaccepted.
4+
* @id cpp/weak-block-mode
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags security
9+
* external/cwe/cwe-327
10+
*/
11+
import cpp
12+
import experimental.crypto.Concepts
13+
14+
from BlockModeAlgorithm alg, string name, string msg, Expr confSink
15+
where
16+
exists(string tmpMsg |
17+
(
18+
(name = alg.getBlockModeName() and name = unknownAlgorithm() and tmpMsg = "Use of unrecognized block mode algorithm.")
19+
or
20+
(
21+
name != unknownAlgorithm() and
22+
name = alg.getBlockModeName() and
23+
not name = ["CBC","CTS","XTS"] and
24+
tmpMsg = "Use of weak block mode algorithm " + name + "."
25+
)
26+
)
27+
and
28+
if alg.hasConfigurationSink() and alg.configurationSink() != alg
29+
then (confSink = alg.configurationSink() and msg = tmpMsg + " Algorithm used at sink: $@.")
30+
else (confSink = alg and msg = tmpMsg)
31+
)
32+
select alg, msg, confSink, confSink.toString()

‎cpp/ql/src/experimental/crypto/example_alerts/WeakEllipticCurve.ql

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* @name Weak elliptic curve
3+
* @description Finds uses of weak, unknown, or otherwise unaccepted elliptic curve algorithms.
4+
* @id cpp/weak-elliptic-curve
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags security
9+
* external/cwe/cwe-327
10+
*/
11+
import cpp
12+
import experimental.crypto.Concepts
13+
14+
from EllipticCurveAlgorithm alg, string name, string msg, Expr confSink
15+
where
16+
exists(string tmpMsg |
17+
(
18+
(name = alg.getCurveName() and name = unknownAlgorithm() and tmpMsg = "Use of unrecognized curve algorithm.")
19+
or
20+
(
21+
name != unknownAlgorithm() and
22+
name = alg.getCurveName() and
23+
not name = ["SECP256R1", "PRIME256V1",//P-256
24+
"SECP384R1", //P-384
25+
"SECP521R1", //P-521
26+
"NUMSP256T1",
27+
"NUMSP384T1",
28+
"NUMSP512T1",
29+
"ED25519", "X25519"] and
30+
tmpMsg = "Use of weak curve algorithm " + name + "."
31+
)
32+
)
33+
and
34+
if alg.hasConfigurationSink() and alg.configurationSink() != alg
35+
then (confSink = alg.configurationSink() and msg = tmpMsg + " Algorithm used at sink: $@.")
36+
else (confSink = alg and msg = tmpMsg)
37+
)
38+
select alg, msg, confSink, confSink.toString()

‎cpp/ql/src/experimental/crypto/example_alerts/WeakEncryption.ql

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* @name Weak cryptography
3+
* @description Finds explicit uses of symmetric encryption algorithms that are weak, unknown, or otherwise unaccepted.
4+
* @kind problem
5+
* @id cpp/weak-crypto/banned-encryption-algorithms
6+
* @problem.severity error
7+
* @precision high
8+
* @tags security
9+
* external/cwe/cwe-327
10+
*/
11+
12+
import cpp
13+
import experimental.crypto.Concepts
14+
15+
16+
from SymmetricEncryptionAlgorithm alg, Expr confSink, string msg
17+
where
18+
exists (string resMsg |
19+
(
20+
if alg.getEncryptionName() = unknownAlgorithm()
21+
then (
22+
alg instanceof Literal and resMsg = "Use of unrecognized symmetric encryption algorithm: " + alg.(Literal).getValueText().toString() + "."
23+
or
24+
not alg instanceof Literal and resMsg = "Use of unrecognized symmetric encryption algorithm."
25+
)
26+
else (not alg.getEncryptionName().matches("AES%") and resMsg = "Use of banned symmetric encryption algorithm: " + alg.getEncryptionName() + ".")
27+
)
28+
and
29+
(
30+
if alg.hasConfigurationSink() and alg.configurationSink() != alg
31+
then (confSink = alg.configurationSink() and msg = resMsg + " Algorithm used at sink: $@.")
32+
else (confSink = alg and msg = resMsg)
33+
)
34+
)
35+
select alg, msg, confSink, confSink.toString()

‎cpp/ql/src/experimental/crypto/example_alerts/WeakHashes.ql

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* @name Weak cryptography
3+
* @description Finds explicit uses of cryptographic hash algorithms that are weak and obsolete.
4+
* @kind problem
5+
* @id cpp/weak-crypto/banned-hash-algorithms
6+
* @problem.severity error
7+
* @precision high
8+
* @tags security
9+
* external/cwe/cwe-327
10+
*/
11+
12+
import cpp
13+
import semmle.code.cpp.dataflow.DataFlow as ASTDataFlow
14+
import experimental.crypto.Concepts
15+
16+
from HashAlgorithm alg, Expr confSink, string msg
17+
where
18+
exists(string name, string msgTmp | name = alg.getHashName() |
19+
not name = ["SHA256", "SHA384", "SHA512"] and
20+
(
21+
if name = unknownAlgorithm()
22+
then
23+
(
24+
not alg instanceof Literal and msgTmp = "Use of unrecognized hash algorithm."
25+
or
26+
alg instanceof Literal and msgTmp = "Use of unrecognized hash algorithm: " + alg.(Literal).getValueText().toString() + "."
27+
28+
)
29+
else msgTmp = "Use of banned hash algorithm " + name + "."
30+
)
31+
and
32+
if alg.hasConfigurationSink() and alg.configurationSink() != alg
33+
then (confSink = alg.configurationSink() and msg = msgTmp + " Algorithm used at sink: $@.")
34+
else (confSink = alg and msg = msgTmp)
35+
)
36+
select alg, msg, confSink, confSink.toString()

0 commit comments

Comments
 (0)