Skip to content

Conversation

@9iang22
Copy link
Contributor

@9iang22 9iang22 commented Dec 23, 2025

Problem:
The rule has an FN case:

  patterns:
  - pattern: |
      Cipher $VAR = $CIPHER.getInstance($MODE); // should be "$MODE"
  - metavariable-regex:
      metavariable: $MODE
      regex: .*ECB.*

It is unable to match situations like:

    String algo = "AES/ECB/NoPadding";
    Cipher c = Cipher.getInstance(algo);  // Incorrectly matches on 'algo', which is the variable name

The fix corrects the usage of $MODE to "$MODE".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant