Skip to content

Commit bdb2f3d

Browse files
geoffw0geoffw0
committed
Rust: Add placeholder query and tests for 'cipher' module.
1 parent 8375c49 commit bdb2f3d

File tree

5 files changed

+145
-0
lines changed

5 files changed

+145
-0
lines changed

‎rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.ql

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/**
2+
* @name Use of a broken or weak cryptographic algorithm
3+
* @description Using broken or weak cryptographic algorithms can compromise security.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 7.5
7+
* @precision high
8+
* @id rust/weak-cryptographic-algorithm
9+
* @tags security
10+
* external/cwe/cwe-327
11+
*/
12+
13+
import rust
14+
15+
from int i
16+
where none()
17+
select i

‎rust/ql/test/query-tests/security/CWE-327/BrokenCryptoAlgorithm.expected

Whitespace-only changes.

‎rust/ql/test/query-tests/security/CWE-327/BrokenCryptoAlgorithm.qlref

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
query: queries/security/CWE-327/BrokenCryptoAlgorithm.ql
2+
postprocess: utils/InlineExpectationsTestQuery.ql

‎rust/ql/test/query-tests/security/CWE-327/options.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
qltest_cargo_check: true
2+
qltest_dependencies:
3+
- cipher = { version = "0.4.4" }
4+
- rc4 = { version = "0.1.0" }
5+
- rabbit = { version = "0.4.1" }
6+
- aes = { version = "0.8.4" }
7+
- des = { version = "0.8.1" }
8+
- rc2 = { version = "0.8.1" }
9+
- rc5 = { version = "0.0.1" }

‎rust/ql/test/query-tests/security/CWE-327/test_cipher.rs

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
2+
use cipher::{consts::*, StreamCipher, KeyInit, KeyIvInit, BlockEncrypt, BlockDecrypt, BlockEncryptMut, BlockDecryptMut};
3+
use rc4::{Rc4};
4+
use rabbit::{Rabbit, RabbitKeyOnly};
5+
use aes::{Aes128, Aes192Enc, Aes256Dec};
6+
use des::{Des, TdesEde2, TdesEde3, TdesEee2, TdesEee3};
7+
use rc2::{Rc2};
8+
use rc5::{RC5_16_16_8, RC5_32_16_16};
9+
10+
// --- tests ---
11+
12+
fn test_stream_cipher(
13+
key128: &[u8;16], iv128: &[u8;16], plaintext: &str
14+
) {
15+
let mut data = plaintext.as_bytes().to_vec();
16+
17+
// rc4 (broken)
18+
let rc4_key = rc4::Key::<U16>::from_slice(key128);
19+
20+
let mut rc4_cipher1 = Rc4::<_>::new(rc4_key); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
21+
rc4_cipher1.apply_keystream(&mut data);
22+
23+
let mut rc4_cipher2 = Rc4::<U16>::new_from_slice(key128).unwrap(); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
24+
rc4_cipher2.apply_keystream(&mut data);
25+
26+
let mut rc4_cipher3 = Rc4::<_>::new(rc4_key); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
27+
let _ = rc4_cipher3.try_apply_keystream(&mut data);
28+
29+
let mut rc4_cipher4 = Rc4::<_>::new(rc4_key); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
30+
let _ = rc4_cipher4.apply_keystream_b2b(plaintext.as_bytes(), &mut data);
31+
32+
// rabbit
33+
let rabbit_key = rabbit::Key::from_slice(key128);
34+
let rabbit_iv = rabbit::Iv::from_slice(iv128);
35+
36+
let mut rabbit_cipher1 = RabbitKeyOnly::new(rabbit_key);
37+
rabbit_cipher1.apply_keystream(&mut data);
38+
39+
let mut rabbit_cipher2 = Rabbit::new(rabbit_key, rabbit_iv);
40+
rabbit_cipher2.apply_keystream(&mut data);
41+
}
42+
43+
fn test_block_cipher(
44+
key: &[u8], key128: &[u8;16], key192: &[u8;24], key256: &[u8;32],
45+
data: &mut [u8], input: &[u8], block128: &mut [u8;16]
46+
) {
47+
// aes
48+
let aes_cipher1 = Aes128::new(key128.into());
49+
aes_cipher1.encrypt_block(block128.into());
50+
aes_cipher1.decrypt_block(block128.into());
51+
52+
let aes_cipher2 = Aes192Enc::new_from_slice(key192).unwrap();
53+
aes_cipher2.encrypt_block(block128.into());
54+
55+
let aes_cipher3 = Aes256Dec::new(key256.into());
56+
aes_cipher3.decrypt_block(block128.into());
57+
58+
// des (broken)
59+
let des_cipher1 = Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
60+
des_cipher1.encrypt_block(data.into());
61+
des_cipher1.decrypt_block(data.into());
62+
63+
let des_cipher2 = des::Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
64+
des_cipher2.encrypt_block(data.into());
65+
des_cipher2.decrypt_block(data.into());
66+
67+
let des_cipher3 = Des::new_from_slice(key).expect("fail"); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
68+
des_cipher3.encrypt_block(data.into());
69+
des_cipher3.decrypt_block(data.into());
70+
71+
let des_cipher4 = Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
72+
des_cipher4.encrypt_block_b2b(input.into(), data.into());
73+
des_cipher4.decrypt_block_b2b(input.into(), data.into());
74+
75+
let mut des_cipher5 = Des::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
76+
des_cipher5.encrypt_block_mut(data.into());
77+
des_cipher5.decrypt_block_mut(data.into());
78+
79+
// triple des (broken)
80+
let tdes_cipher1 = TdesEde2::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
81+
tdes_cipher1.encrypt_block(data.into());
82+
tdes_cipher1.decrypt_block(data.into());
83+
84+
let tdes_cipher2 = TdesEde3::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
85+
tdes_cipher2.encrypt_block(data.into());
86+
tdes_cipher2.decrypt_block(data.into());
87+
88+
let tdes_cipher3 = TdesEee2::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
89+
tdes_cipher3.encrypt_block(data.into());
90+
tdes_cipher3.decrypt_block(data.into());
91+
92+
let tdes_cipher4 = TdesEee3::new_from_slice(key).unwrap(); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
93+
tdes_cipher4.encrypt_block(data.into());
94+
tdes_cipher4.decrypt_block(data.into());
95+
96+
// rc2 (broken)
97+
let rc2_cipher1 = Rc2::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
98+
rc2_cipher1.encrypt_block(data.into());
99+
rc2_cipher1.decrypt_block(data.into());
100+
101+
let rc2_cipher2 = Rc2::new_from_slice(key).expect("fail"); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
102+
rc2_cipher2.encrypt_block(data.into());
103+
rc2_cipher2.decrypt_block(data.into());
104+
105+
let rc2_cipher3 = Rc2::new_with_eff_key_len(key, 64); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
106+
rc2_cipher3.encrypt_block(data.into());
107+
rc2_cipher3.decrypt_block(data.into());
108+
109+
// rc5 (broken)
110+
let rc5_cipher1 = RC5_16_16_8::new(key.into()); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
111+
rc5_cipher1.encrypt_block(data.into());
112+
rc5_cipher1.decrypt_block(data.into());
113+
114+
let rc5_cipher2 = RC5_32_16_16::new_from_slice(key).unwrap(); // $ MISSING: Alert[rust/weak-cryptographic-algorithm]
115+
rc5_cipher2.encrypt_block(data.into());
116+
rc5_cipher2.decrypt_block(data.into());
117+
}

0 commit comments

Comments
 (0)