Skip to content

Commit 5b7f9b8

Browse files
p4p3rp4p3r
authored
Merge pull request #3544 from semgrep/merge-develop-to-release
Merge Develop into Release
2 parents 0eb6a07 + 1c92567 commit 5b7f9b8

File tree

12 files changed

+389
-4
lines changed

12 files changed

+389
-4
lines changed

‎go/lang/security/audit/crypto/sha224-hash.go‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package main
2+
3+
import (
4+
"crypto/sha256"
5+
"golang.org/x/crypto/sha3"
6+
"fmt"
7+
"io"
8+
"log"
9+
"os"
10+
)
11+
12+
func main() {
13+
}
14+
15+
func test_sha224() {
16+
f, err := os.Open("file.txt")
17+
if err != nil {
18+
log.Fatal(err)
19+
}
20+
defer f.Close()
21+
// ruleid: sha224-hash
22+
h := sha256.New224()
23+
if _, err := io.Copy(h, f); err != nil {
24+
log.Fatal(err)
25+
}
26+
// ruleid: sha224-hash
27+
fmt.Printf("%x", sha256.Sum224(nil))
28+
}
29+
30+
func test_sha3_224() {
31+
f, err := os.Open("file.txt")
32+
if err != nil {
33+
log.Fatal(err)
34+
}
35+
defer f.Close()
36+
// ruleid: sha224-hash
37+
h := sha3.New224()
38+
if _, err := io.Copy(h, f); err != nil {
39+
log.Fatal(err)
40+
}
41+
// ruleid: sha224-hash
42+
fmt.Printf("%x", sha3.Sum224(nil))
43+
}

‎go/lang/security/audit/crypto/sha224-hash.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
rules:
2+
- id: sha224-hash
3+
pattern-either:
4+
- patterns:
5+
- pattern-inside: |
6+
import "crypto/sha256"
7+
...
8+
- pattern-either:
9+
- pattern: |
10+
sha256.New224()
11+
- pattern: |
12+
sha256.Sum224(...)
13+
- patterns:
14+
- pattern-inside: |
15+
import "golang.org/x/crypto/sha3"
16+
...
17+
- pattern-either:
18+
- pattern: |
19+
sha3.New224()
20+
- pattern: |
21+
sha3.Sum224(...)
22+
message: >-
23+
This code uses a 224-bit hash function, which is deprecated or disallowed
24+
in some security policies. Consider updating to a stronger hash function such
25+
as SHA-384 or higher to ensure compliance and security.
26+
languages: [go]
27+
severity: WARNING
28+
metadata:
29+
owasp:
30+
- A03:2017 - Sensitive Data Exposure
31+
- A02:2021 - Cryptographic Failures
32+
cwe:
33+
- 'CWE-328: Use of Weak Hash'
34+
category: security
35+
technology:
36+
- go
37+
references:
38+
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
39+
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
40+
subcategory:
41+
- vuln
42+
likelihood: LOW
43+
impact: LOW
44+
confidence: HIGH

‎java/lang/security/audit/crypto/use-of-sha224.java‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
import java.security.MessageDigest;
2+
import org.apache.commons.codec.digest.DigestUtils;
3+
import static org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_224;
4+
5+
public class Bad {
6+
public byte[] bad1(String password) {
7+
// ruleid: use-of-sha224
8+
MessageDigest sha224Digest = MessageDigest.getInstance("SHA-224");
9+
sha224Digest.update(password.getBytes());
10+
byte[] hashValue = sha224Digest.digest();
11+
return hashValue;
12+
}
13+
14+
public byte[] bad2(String password) {
15+
// ruleid: use-of-sha224
16+
byte[] hashValue = DigestUtils.getSha3_224Digest().digest(password.getBytes());
17+
return hashValue;
18+
}
19+
20+
public void bad3() {
21+
// ruleid: use-of-sha224
22+
java.security.MessageDigest md = java.security.MessageDigest.getInstance("sha224", "SUN");
23+
byte[] input = { (byte) '?' };
24+
Object inputParam = bar;
25+
if (inputParam instanceof String)
26+
input = ((String) inputParam).getBytes();
27+
if (inputParam instanceof java.io.InputStream) {
28+
byte[] strInput = new byte[1000];
29+
int i = ((java.io.InputStream) inputParam).read(strInput);
30+
if (i == -1) {
31+
response.getWriter()
32+
.println(
33+
"This input source requires a POST, not a GET. Incompatible UI for the InputStream source.");
34+
return;
35+
}
36+
input = java.util.Arrays.copyOf(strInput, i);
37+
}
38+
md.update(input);
39+
byte[] result = md.digest();
40+
java.io.File fileTarget = new java.io.File(
41+
new java.io.File(org.owasp.benchmark.helpers.Utils.TESTFILES_DIR),
42+
"passwordFile.txt");
43+
java.io.FileWriter fw = new java.io.FileWriter(fileTarget, true); // the true will append the new data
44+
fw.write(
45+
"hash_value="
46+
+ org.owasp.esapi.ESAPI.encoder().encodeForBase64(result, true)
47+
+ "\n");
48+
fw.close();
49+
}
50+
51+
public byte[] bad4(String password) {
52+
// ruleid: use-of-sha224
53+
byte [] hashValue = new DigestUtils(SHA_224).digest(password.getBytes());
54+
return hashValue;
55+
}
56+
}

‎java/lang/security/audit/crypto/use-of-sha224.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
rules:
2+
- id: use-of-sha224
3+
message: >-
4+
This code uses a 224-bit hash function, which is deprecated or disallowed
5+
in some security policies. Consider updating to a stronger hash function such
6+
as SHA-384 or higher to ensure compliance and security.
7+
languages: [java]
8+
severity: WARNING
9+
metadata:
10+
functional-categories:
11+
- 'crypto::search::hash-algorithm::javax.crypto'
12+
owasp:
13+
- A03:2017 - Sensitive Data Exposure
14+
- A02:2021 - Cryptographic Failures
15+
cwe:
16+
- 'CWE-328: Use of Weak Hash'
17+
asvs:
18+
section: V6 Stored Cryptography Verification Requirements
19+
control_id: 6.2.5 Insecure Algorithm
20+
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
21+
version: '4'
22+
category: security
23+
technology:
24+
- java
25+
references:
26+
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
27+
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
28+
subcategory:
29+
- vuln
30+
likelihood: LOW
31+
impact: LOW
32+
confidence: HIGH
33+
pattern-either:
34+
- pattern: org.apache.commons.codec.digest.DigestUtils.getSha3_224Digest()
35+
- pattern: org.apache.commons.codec.digest.DigestUtils.getSha512_224Digest()
36+
- pattern: org.apache.commons.codec.digest.DigestUtils.sha3_224(...)
37+
- pattern: org.apache.commons.codec.digest.DigestUtils.sha3_224Hex(...)
38+
- pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224(...)
39+
- pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224Hex(...)
40+
- pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_224)
41+
- pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_512_224)
42+
- pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA3_224)
43+
- patterns:
44+
- pattern: java.security.MessageDigest.getInstance("$ALGO", ...);
45+
- metavariable-regex:
46+
metavariable: $ALGO
47+
regex: '.*224'

‎php/lang/security/audit/sha224-hash.php‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?php
2+
3+
// ruleid: sha224-hash
4+
var_dump(hash('sha224', 'mypassword'));
5+
6+
// ruleid: sha224-hash
7+
var_dump(hash('sha512/224', 'mypassword'));
8+
9+
// ruleid: sha224-hash
10+
var_dump(hash('sha3-224', 'mypassword'));
11+
12+
// ruleid: sha224-hash
13+
var_dump(hash_hmac('sha224', 'mypassword'));
14+
15+
// ruleid: sha224-hash
16+
var_dump(hash_hmac('sha512/224', 'mypassword'));
17+
18+
// ruleid: sha224-hash
19+
var_dump(hash_hmac('sha3-224', 'mypassword'));
20+
21+
// ok: sha224-hash
22+
var_dump(hash('sha384', 'mypassword'));

‎php/lang/security/audit/sha224-hash.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
rules:
2+
- id: sha224-hash
3+
pattern-either:
4+
- pattern: hash('sha224', ...);
5+
- pattern: hash('sha512/224', ...);
6+
- pattern: hash('sha3-224', ...);
7+
- pattern: hash_hmac('sha224', ...);
8+
- pattern: hash_hmac('sha512/224', ...);
9+
- pattern: hash_hmac('sha3-224', ...);
10+
message: >-
11+
This code uses a 224-bit hash function, which is deprecated or disallowed
12+
in some security policies. Consider updating to a stronger hash function such
13+
as SHA-384 or higher to ensure compliance and security.
14+
metadata:
15+
cwe:
16+
- 'CWE-328: Use of Weak Hash'
17+
references:
18+
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
19+
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
20+
category: security
21+
technology:
22+
- php
23+
owasp:
24+
- A03:2017 - Sensitive Data Exposure
25+
- A02:2021 - Cryptographic Failures
26+
subcategory:
27+
- audit
28+
likelihood: LOW
29+
impact: LOW
30+
confidence: HIGH
31+
languages: [php]
32+
severity: WARNING

‎php/lang/security/weak-crypto.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,12 @@
2020

2121
// ok: weak-crypto
2222
$hashed_password = sodium_crypto_generichash('mypassword');
23+
24+
// ruleid: weak-crypto
25+
var_dump(hash("sha1", "hello"));
26+
27+
// ruleid: weak-crypto
28+
var_dump(hash("md5", "hello"));
29+
30+
// ok: weak-crypto
31+
var_dump(hash("sha384", "hello"));

‎php/lang/security/weak-crypto.yaml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
rules:
22
- id: weak-crypto
33
patterns:
4-
- pattern: $FUNC(...);
5-
- metavariable-regex:
6-
metavariable: $FUNC
7-
regex: crypt|md5|md5_file|sha1|sha1_file|str_rot13
4+
- pattern-either:
5+
- pattern: crypt(...)
6+
- pattern: hash('md5', ...)
7+
- pattern: hash('sha1', ...)
8+
- pattern: md5_file(...)
9+
- pattern: md5(...)
10+
- pattern: sha1_file(...)
11+
- pattern: sha1(...)
12+
- pattern: str_rot13(...)
813
message: >-
914
Detected usage of weak crypto function. Consider using stronger alternatives.
1015
metadata:

‎python/lang/security/audit/sha224-hash.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
import hashlib
2+
3+
# ruleid:sha224-hash
4+
hashlib.sha224(b"1")
5+
6+
# ruleid:sha224-hash
7+
hashlib.sha3_224(b"1")
8+
9+
# ok:sha224-hash
10+
hashlib.sha384(b"1")

‎python/lang/security/audit/sha224-hash.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
rules:
2+
- id: sha224-hash
3+
message: >-
4+
This code uses a 224-bit hash function, which is deprecated or disallowed
5+
in some security policies. Consider updating to a stronger hash function such
6+
as SHA-384 or higher to ensure compliance and security.
7+
metadata:
8+
cwe:
9+
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
10+
owasp:
11+
- A03:2017 - Sensitive Data Exposure
12+
- A02:2021 - Cryptographic Failures
13+
references:
14+
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
15+
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
16+
category: security
17+
technology:
18+
- python
19+
subcategory:
20+
- vuln
21+
likelihood: LOW
22+
impact: LOW
23+
confidence: HIGH
24+
severity: WARNING
25+
languages:
26+
- python
27+
pattern-either:
28+
- pattern: hashlib.sha224(...)
29+
- pattern: hashlib.sha3_224(...)

0 commit comments

Comments
 (0)