Skip to content

Commit 94dbad7

Browse files
geoffw0geoffw0
committed
Rust: Model for cipher traits.
1 parent eeeb142 commit 94dbad7

File tree

4 files changed

+62
-13
lines changed

4 files changed

+62
-13
lines changed

‎rust/ql/lib/codeql/rust/Frameworks.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,6 @@
33
*/
44

55
private import codeql.rust.frameworks.Reqwest
6+
private import codeql.rust.frameworks.RustCrypto
67
private import codeql.rust.frameworks.stdlib.Env
78
private import codeql.rust.frameworks.Sqlx

‎rust/ql/lib/codeql/rust/frameworks/RustCrypto.qll

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Provides modeling for the `RustCrypto` family of crates (`cipher`, `digest` etc).
3+
*/
4+
5+
private import rust
6+
private import codeql.rust.Concepts
7+
private import codeql.rust.dataflow.DataFlow
8+
9+
/**
10+
* An operation that initializes a cipher through the `cipher::KeyInit` or
11+
* `cipher::KeyIvInit` trait, for example `Des::new` or `cbc::Encryptor<des::Des>::new`.
12+
*/
13+
class StreamCipherInit extends Cryptography::CryptographicOperation::Range, DataFlow::Node {
14+
string algorithmName;
15+
16+
StreamCipherInit() {
17+
// a call to `cipher::KeyInit::new`, `cipher::KeyInit::new_from_slice`,
18+
// `cipher::KeyIvInit::new` or `cipher::KeyIvInit::new_from_slices`.
19+
exists(Path p |
20+
this.asExpr().getExpr().(CallExpr).getFunction().(PathExpr).getPath() = p and
21+
p.getResolvedCrateOrigin().matches("%/RustCrypto%") and
22+
p.getPart().getNameRef().getText() =
23+
["new", "new_from_slice", "new_from_slices"] and
24+
algorithmName = p.getQualifier().getPart().getNameRef().getText()
25+
)
26+
}
27+
28+
override DataFlow::Node getInitialization() { result = this }
29+
30+
override Cryptography::CryptographicAlgorithm getAlgorithm() { result.matchesName(algorithmName) }
31+
32+
override DataFlow::Node getAnInput() { none() }
33+
34+
override Cryptography::BlockMode getBlockMode() { result = "" }
35+
}

‎rust/ql/test/query-tests/security/CWE-327/BrokenCryptoAlgorithm.expected

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
| test_cipher.rs:20:27:20:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:20:27:20:48 | ...::new(...) | The cryptographic algorithm RC4 |
2+
| test_cipher.rs:23:27:23:60 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:23:27:23:60 | ...::new_from_slice(...) | The cryptographic algorithm RC4 |
3+
| test_cipher.rs:26:27:26:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:26:27:26:48 | ...::new(...) | The cryptographic algorithm RC4 |
4+
| test_cipher.rs:29:27:29:48 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:29:27:29:48 | ...::new(...) | The cryptographic algorithm RC4 |
5+
| test_cipher.rs:59:23:59:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:59:23:59:42 | ...::new(...) | The cryptographic algorithm DES |
6+
| test_cipher.rs:63:23:63:47 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:63:23:63:47 | ...::new(...) | The cryptographic algorithm DES |
7+
| test_cipher.rs:67:23:67:46 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:67:23:67:46 | ...::new_from_slice(...) | The cryptographic algorithm DES |
8+
| test_cipher.rs:71:23:71:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:71:23:71:42 | ...::new(...) | The cryptographic algorithm DES |
9+
| test_cipher.rs:75:27:75:46 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:75:27:75:46 | ...::new(...) | The cryptographic algorithm DES |
10+
| test_cipher.rs:97:23:97:42 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:97:23:97:42 | ...::new(...) | The cryptographic algorithm RC2 |
11+
| test_cipher.rs:101:23:101:46 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:101:23:101:46 | ...::new_from_slice(...) | The cryptographic algorithm RC2 |
12+
| test_cipher.rs:110:23:110:50 | ...::new(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:110:23:110:50 | ...::new(...) | The cryptographic algorithm RC5 |
13+
| test_cipher.rs:114:23:114:55 | ...::new_from_slice(...) | $@ is broken or weak, and should not be used. | test_cipher.rs:114:23:114:55 | ...::new_from_slice(...) | The cryptographic algorithm RC5 |

‎rust/ql/test/query-tests/security/CWE-327/test_cipher.rs

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,16 @@ fn test_stream_cipher(
1717
// rc4 (broken)
1818
let rc4_key = rc4::Key::<U16>::from_slice(key128);
1919

20-
let mut rc4_cipher1 = Rc4::<_>::new(rc4_key); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
20+
let mut rc4_cipher1 = Rc4::<_>::new(rc4_key); // $ Alert[rust/weak-cryptographic-algorithm]
2121
rc4_cipher1.apply_keystream(&mut data);
2222

23-
let mut rc4_cipher2 = Rc4::<U16>::new_from_slice(key128).unwrap(); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
23+
let mut rc4_cipher2 = Rc4::<U16>::new_from_slice(key128).unwrap(); // $ Alert[rust/weak-cryptographic-algorithm]
2424
rc4_cipher2.apply_keystream(&mut data);
2525

26-
let mut rc4_cipher3 = Rc4::<_>::new(rc4_key); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
26+
let mut rc4_cipher3 = Rc4::<_>::new(rc4_key); // $ Alert[rust/weak-cryptographic-algorithm]
2727
let _ = rc4_cipher3.try_apply_keystream(&mut data);
2828

29-
let mut rc4_cipher4 = Rc4::<_>::new(rc4_key); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
29+
let mut rc4_cipher4 = Rc4::<_>::new(rc4_key); // $ Alert[rust/weak-cryptographic-algorithm]
3030
let _ = rc4_cipher4.apply_keystream_b2b(plaintext.as_bytes(), &mut data);
3131

3232
// rabbit
@@ -56,23 +56,23 @@ fn test_block_cipher(
5656
aes_cipher3.decrypt_block(block128.into());
5757

5858
// des (broken)
59-
let des_cipher1 = Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
59+
let des_cipher1 = Des::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
6060
des_cipher1.encrypt_block(data.into());
6161
des_cipher1.decrypt_block(data.into());
6262

63-
let des_cipher2 = des::Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
63+
let des_cipher2 = des::Des::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
6464
des_cipher2.encrypt_block(data.into());
6565
des_cipher2.decrypt_block(data.into());
6666

67-
let des_cipher3 = Des::new_from_slice(key).expect("fail"); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
67+
let des_cipher3 = Des::new_from_slice(key).expect("fail"); // $ Alert[rust/weak-cryptographic-algorithm]
6868
des_cipher3.encrypt_block(data.into());
6969
des_cipher3.decrypt_block(data.into());
7070

71-
let des_cipher4 = Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
71+
let des_cipher4 = Des::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
7272
des_cipher4.encrypt_block_b2b(input.into(), data.into());
7373
des_cipher4.decrypt_block_b2b(input.into(), data.into());
7474

75-
let mut des_cipher5 = Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
75+
let mut des_cipher5 = Des::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
7676
des_cipher5.encrypt_block_mut(data.into());
7777
des_cipher5.decrypt_block_mut(data.into());
7878

@@ -94,11 +94,11 @@ fn test_block_cipher(
9494
tdes_cipher4.decrypt_block(data.into());
9595

9696
// rc2 (broken)
97-
let rc2_cipher1 = Rc2::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
97+
let rc2_cipher1 = Rc2::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
9898
rc2_cipher1.encrypt_block(data.into());
9999
rc2_cipher1.decrypt_block(data.into());
100100

101-
let rc2_cipher2 = Rc2::new_from_slice(key).expect("fail"); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
101+
let rc2_cipher2 = Rc2::new_from_slice(key).expect("fail"); // $ Alert[rust/weak-cryptographic-algorithm]
102102
rc2_cipher2.encrypt_block(data.into());
103103
rc2_cipher2.decrypt_block(data.into());
104104

@@ -107,11 +107,11 @@ fn test_block_cipher(
107107
rc2_cipher3.decrypt_block(data.into());
108108

109109
// rc5 (broken)
110-
let rc5_cipher1 = RC5_16_16_8::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
110+
let rc5_cipher1 = RC5_16_16_8::new(key.into()); // $ Alert[rust/weak-cryptographic-algorithm]
111111
rc5_cipher1.encrypt_block(data.into());
112112
rc5_cipher1.decrypt_block(data.into());
113113

114-
let rc5_cipher2 = RC5_32_16_16::new_from_slice(key).unwrap(); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
114+
let rc5_cipher2 = RC5_32_16_16::new_from_slice(key).unwrap(); // $ Alert[rust/weak-cryptographic-algorithm]
115115
rc5_cipher2.encrypt_block(data.into());
116116
rc5_cipher2.decrypt_block(data.into());
117117
}

0 commit comments

Comments
 (0)