overlay[local?]

module;

import java

import semmle.code.java.dataflow.DataFlow

import semmle.code.java.dataflow.TaintTracking

import semmle.code.java.controlflow.Dominance

module JCAModel {

import Language

import codeql.quantum.experimental.Standardization::Types::KeyOpAlg as KeyOpAlg

abstract class CipherAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer { }

abstract class EllipticCurveAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer { }

abstract class HashAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer { }

abstract class KeyAgreementAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer { }

abstract class SignatureAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer { }

abstract class MacAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer { }

// TODO: Verify that the PBEWith% case works correctly

bindingset[algo]

predicate cipher_names(string algo) {

algo.toUpperCase()

.matches([

"AES", "AESWrap", "AESWrapPad", "ARCFOUR", "Blowfish", "ChaCha20", "ChaCha20-Poly1305",

"DES", "DESede", "DESedeWrap", "ECIES", "PBEWith%", "RC2", "RC4", "RC5", "RSA",

"Skipjack", "Idea"

].toUpperCase())

}

// TODO: Verify that the OAEPWith% case works correctly

bindingset[padding]

predicate cipher_padding(string padding) {

padding

.toUpperCase()

.matches([

"NoPadding", "ISO10126Padding", "OAEPPadding", "OAEPWith%", "PKCS1Padding",

"PKCS5Padding", "SSL3Padding"

].toUpperCase())

}

bindingset[hash]

predicate hash_names(string hash) { exists(hash_name_to_type_known(hash, _)) }

bindingset[kdf]

predicate kdf_names(string kdf) {

kdf.toUpperCase().matches(["PBKDF2With%", "PBEWith%"].toUpperCase())

}

bindingset[name]

predicate elliptic_curve_names(string name) {

// Note: as a one-off exception, we use the internal Crypto module implementation of `isEllipticCurveAlgorithmName`

Crypto::isEllipticCurveAlgorithmName(name)

}

/*

* TODO:

*

* MAC Algorithms possible (JCA Default + BouncyCastle Extensions)

*

* Name Type Description

* ---------------------------------------------------------------------------

* "HmacMD5" HMAC HMAC with MD5 (not recommended)

* "HmacSHA1" HMAC HMAC with SHA-1 (not recommended)

* "HmacSHA224" HMAC HMAC with SHA-224

* "HmacSHA256" HMAC HMAC with SHA-256

* "HmacSHA384" HMAC HMAC with SHA-384

* "HmacSHA512" HMAC HMAC with SHA-512

*

* (BouncyCastle and Other Provider Extensions)

* "AESCMAC" CMAC Cipher-based MAC using AES

* "DESCMAC" CMAC CMAC with DES (legacy)

* "GMAC" GCM-based MAC Authenticates AAD only (GCM-style)

* "Poly1305" AEAD-style MAC Used with ChaCha20

* "SipHash" Hash-based MAC Fast MAC for short inputs

* "BLAKE2BMAC" HMAC-style BLAKE2b MAC (cryptographic hash)

* "HmacRIPEMD160" HMAC HMAC with RIPEMD160 hash

*/

bindingset[name]

predicate mac_names(string name) {

name.toUpperCase()

.matches([

"HMAC%", "AESCMAC", "DESCMAC", "GMAC", "Poly1305", "SipHash", "BLAKE2BMAC",

"HMACRIPEMD160", "%CMAC"

].toUpperCase())

}

/**

* Names that match known signature algorithms.

* https://docs.oracle.com/en/java/javase/25/docs/specs/security/standard-names.html

*/

bindingset[name]

predicate signature_names(string name) {

name.toUpperCase().splitAt("WITH", 1).matches(["RSA%", "ECDSA%", "DSA%"])

or

name.toUpperCase()

.matches(["RSASSA-PSS", "ED25519", "ED448", "EDDSA", "ML-DSA%", "HSS/LMS", "DSA"])

}

bindingset[name]

predicate key_agreement_names(string name) {

name.toUpperCase()

.matches(["DH", "EDH", "ECDH", "X25519", "X448", "ML-KEM%", "XDH"].toUpperCase())

}

bindingset[name]

Crypto::TKeyDerivationType kdf_name_to_kdf_type(string name, string withSubstring) {

name.matches("PBKDF2With%") and

result instanceof Crypto::PBKDF2 and

withSubstring = name.regexpCapture("PBKDF2With(.*)", 1)

or

name.matches("PBEWith%") and

result instanceof Crypto::PBES and

withSubstring = name.regexpCapture("PBEWith(.*)", 1)

// TODO: add additional

}

bindingset[nameRaw]

Crypto::HashType hash_name_to_type_known(string nameRaw, int digestLength) {

exists(string name | name = nameRaw.toUpperCase() |

name in ["SHA-1", "SHA1"] and result instanceof Crypto::SHA1 and digestLength = 160

or

name in ["SHA-256", "SHA-224", "SHA-384", "SHA-512", "SHA224", "SHA256", "SHA384", "SHA512"] and

result instanceof Crypto::SHA2 and

digestLength = name.replaceAll("-", "").splitAt("SHA", 1).toInt()

or

name in ["SHA-512/224", "SHA-512/256", "SHA512/224", "SHA512/256"] and

result instanceof Crypto::SHA2 and

digestLength = name.replaceAll("-", "").splitAt("SHA-512/", 1).toInt()

or

name in ["SHA3-224", "SHA3-256", "SHA3-384", "SHA3-512", "SHA3256", "SHA3384", "SHA3512"] and

result instanceof Crypto::SHA3 and

digestLength = name.replaceAll("-", "").splitAt("SHA3", 1).toInt()

or

(

name.toUpperCase().matches("BLAKE2B%") and

result instanceof Crypto::BLAKE2B

or

name.toUpperCase() = "BLAKE2S" and result instanceof Crypto::BLAKE2S

) and

(

if exists(name.indexOf("-"))

then name.splitAt("-", 1).toInt() = digestLength

else digestLength = 512

)

or

name = "MD5" and

result instanceof Crypto::MD5 and

digestLength = 128

or

name = "RIPEMD160" and

result instanceof Crypto::RIPEMD160 and

digestLength = 160

or

name = "WHIRLPOOL" and

result instanceof Crypto::WHIRLPOOL and

digestLength = 512 // TODO: verify

)

}

bindingset[name]

private predicate mode_name_to_type_known(KeyOpAlg::ModeOfOperationType type, string name) {

type = KeyOpAlg::ECB() and name = "ECB"

or

type = KeyOpAlg::CBC() and name = "CBC"

or

type = KeyOpAlg::GCM() and name = "GCM"

or

type = KeyOpAlg::CTR() and name = "CTR"

or

type = KeyOpAlg::XTS() and name = "XTS"

or

type = KeyOpAlg::CCM() and name = "CCM"

or

type = KeyOpAlg::SIV() and name = "SIV"

or

type = KeyOpAlg::OCB() and name = "OCB"

or

type = KeyOpAlg::CFB() and name = "CFB"

or

type = KeyOpAlg::OFB() and name = "OFB"

or

type = KeyOpAlg::PCBC() and name = "PCBC"

or

type = KeyOpAlg::KWP() and name = "KWP"

}

bindingset[name]

private predicate cipher_name_to_type_known(KeyOpAlg::TAlgorithm type, string name) {

exists(string upper | upper = name.toUpperCase() |

upper.matches("AES%") and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::AES())

or

// NOTE: there is DES and DESede

upper.matches("DES%") and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::DES())

or

upper = "TRIPLEDES" and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::TRIPLE_DES())

or

upper = "IDEA" and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::IDEA())

or

upper = "CAST5" and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::CAST5())

or

upper = "CHACHA20" and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::CHACHA20())

or

upper = "RC2" and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::RC2())

or

upper = "RC4" and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::RC4())

or

upper = "RC5" and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::RC5())

or

upper = "RSA" and

type = KeyOpAlg::TAsymmetricCipher(KeyOpAlg::RSA())

or

upper = "SKIPJACK" and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::SKIPJACK())

or

upper = "BLOWFISH" and

type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::BLOWFISH())

)

}

bindingset[name]

predicate key_agreement_name_to_type_known(Crypto::TKeyAgreementType type, string name) {

type = Crypto::DH() and

name.toUpperCase() = "DH"

or

type = Crypto::EDH() and

name.toUpperCase() = "EDH"

or

type = Crypto::ECDH() and

name.toUpperCase() in ["ECDH", "X25519", "X448", "XDH"]

or

type = Crypto::OtherKeyAgreementType() and

name.toUpperCase().matches("ML-KEM%")

}

/**

* Maps a signature algorithm name to its type, if known.

* see https://docs.oracle.com/en/java/javase/25/docs/specs/security/standard-names.html

*/

bindingset[name]

predicate signature_name_to_type_known(Crypto::KeyOpAlg::TAlgorithm type, string name) {

name.toUpperCase().splitAt("with".toUpperCase(), 1).matches("RSA%") and

type = KeyOpAlg::TAsymmetricCipher(KeyOpAlg::RSA())

or

name.toUpperCase().splitAt("with".toUpperCase(), 1).matches("ECDSA%") and

type = KeyOpAlg::TSignature(KeyOpAlg::ECDSA())

or

name.toUpperCase().splitAt("with".toUpperCase(), 1).matches("DSA%") and

type = KeyOpAlg::TSignature(KeyOpAlg::DSA())

or

name.toUpperCase() = "RSASSA-PSS" and type = KeyOpAlg::TAsymmetricCipher(KeyOpAlg::RSA())

or

name.toUpperCase().matches(["EDDSA", "ED25519", "ED448"]) and

type = KeyOpAlg::TSignature(KeyOpAlg::EDDSA())

or

name.toUpperCase().matches("ML-DSA%") and type = KeyOpAlg::TSignature(KeyOpAlg::DSA())

or

name.toUpperCase() = "HSS/LMS" and type = KeyOpAlg::TSignature(KeyOpAlg::HSS_LMS())

or

name.toUpperCase() = "DSA" and type = KeyOpAlg::TSignature(KeyOpAlg::DSA())

}

bindingset[name]

Crypto::HashType signature_name_to_hash_type_known(string name, int digestLength) {

result = hash_name_to_type_known(name.splitAt("with", 0), digestLength)

}

/**

* A `JavaConstant` in the `"ALG/MODE/PADDING"` or `"ALG"` format

*/

class CipherStringLiteral extends JavaConstant {

CipherStringLiteral() { cipher_names(this.getValue().splitAt("/")) }

string getAlgorithmName() { result = this.getValue().splitAt("/", 0) }

string getMode() { result = this.getValue().splitAt("/", 1) }

string getPadding() { result = this.getValue().splitAt("/", 2) }

}

class CipherGetInstanceCall extends MethodCall {

CipherGetInstanceCall() {

this.getCallee().hasQualifiedName(javaxOrJakarta() + ".crypto", "Cipher", "getInstance")

}

Expr getAlgorithmArg() { result = this.getArgument(0) }

Expr getProviderArg() { result = this.getArgument(1) }

}

// TODO: handle key artifact produced by unwrap

private class CipherOperationCall extends MethodCall {

CipherOperationCall() {

this.getMethod()

.hasQualifiedName(javaxOrJakarta() + ".crypto", "Cipher",

["update", "doFinal", "wrap", "unwrap"])

}

predicate isIntermediate() { this.getMethod().getName() = "update" }

Expr getInput() { result = this.getArgument(0) }

Expr getOutput() {

exists(int outputIndex | this.getMethod().getParameter(outputIndex).getName() = "output" |

result = this.getArgument(outputIndex)

)

or

this.getMethod().getReturnType().hasName("byte[]") and result = this

}

DataFlow::Node getMessageArg() { result.asExpr() = this.getInput() }

}

/**

* Data-flow configuration modeling flow from a cipher string literal to a cipher algorithm consumer.

*/

private module CipherAlgorithmStringToCipherConsumerConfig implements DataFlow::ConfigSig {

predicate isSource(DataFlow::Node src) { src.asExpr() instanceof CipherStringLiteral }

predicate isSink(DataFlow::Node sink) {

sink = any(CipherAlgorithmValueConsumer call).getInputNode()

}

}

module CipherAlgorithmStringToFetchFlow =

TaintTracking::Global<CipherAlgorithmStringToCipherConsumerConfig>;

/**

* Note: padding and a mode of operation will only exist when the padding / mode (*and its type*) are determinable.

* This is because the mode will always be specified alongside the algorithm and never independently.

* Therefore, we can always assume that a determinable algorithm will have a determinable mode.

*

* In the case that only an algorithm is specified, e.g., "AES", the provider provides a default mode.

*

* TODO: Model the case of relying on a provider default, but alert on it as a bad practice.

*/

class CipherStringLiteralPaddingAlgorithmInstance extends CipherStringLiteralAlgorithmInstance,

Crypto::PaddingAlgorithmInstance instanceof CipherStringLiteral

{

CipherStringLiteralPaddingAlgorithmInstance() { exists(super.getPadding()) } // TODO: provider defaults

override string getRawPaddingAlgorithmName() { result = super.getPadding() }

bindingset[name]

private predicate paddingToNameMappingKnown(KeyOpAlg::PaddingSchemeType type, string name) {

type instanceof KeyOpAlg::NoPadding and name = "NOPADDING"

or

type instanceof KeyOpAlg::PKCS7 and name = ["PKCS5Padding", "PKCS7Padding"] // TODO: misnomer in the JCA?

or

type instanceof KeyOpAlg::OAEP and name.matches("OAEP%") // TODO: handle OAEPWith%

}

override KeyOpAlg::PaddingSchemeType getPaddingType() {

if this.paddingToNameMappingKnown(_, super.getPadding())

then this.paddingToNameMappingKnown(result, super.getPadding())

else result instanceof KeyOpAlg::OtherPadding

}

}

class CipherStringLiteralModeAlgorithmInstance extends CipherStringLiteralPaddingAlgorithmInstance,

Crypto::ModeOfOperationAlgorithmInstance instanceof CipherStringLiteral

{

CipherStringLiteralModeAlgorithmInstance() { exists(super.getMode()) } // TODO: provider defaults

override string getRawModeAlgorithmName() { result = super.getMode() }

override KeyOpAlg::ModeOfOperationType getModeType() {

if mode_name_to_type_known(_, super.getMode())

then mode_name_to_type_known(result, super.getMode())

else result instanceof KeyOpAlg::OtherMode

}

}

class CipherStringLiteralAlgorithmInstance extends Crypto::KeyOperationAlgorithmInstance instanceof CipherStringLiteral

{

CipherAlgorithmValueConsumer consumer;

CipherStringLiteralAlgorithmInstance() {

CipherAlgorithmStringToFetchFlow::flow(DataFlow::exprNode(this), consumer.getInputNode())

}

CipherAlgorithmValueConsumer getConsumer() { result = consumer }

override Crypto::ModeOfOperationAlgorithmInstance getModeOfOperationAlgorithm() {

result = this // TODO: provider defaults

}

override Crypto::PaddingAlgorithmInstance getPaddingAlgorithm() {

result = this // TODO: provider defaults

}

override string getRawAlgorithmName() { result = super.getValue() }

override KeyOpAlg::AlgorithmType getAlgorithmType() {

if cipher_name_to_type_known(_, super.getAlgorithmName())

then cipher_name_to_type_known(result, super.getAlgorithmName())

else result instanceof KeyOpAlg::TOtherKeyOperationAlgorithmType

}

override int getKeySizeFixed() {

none() // TODO: implement to handle variants such as AES-128

}

override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() { none() }

}

bindingset[input]

predicate oaep_padding_string_components(string input, string hash, string mfg) {

exists(string regex |

regex = "OAEPWith(.*)And(.*)Padding" and

hash = input.regexpCapture(regex, 1) and

mfg = input.regexpCapture(regex, 2)

)

}

predicate oaep_padding_string_components_eval(string hash, string mfg) {

oaep_padding_string_components(any(CipherStringLiteral s).getPadding(), hash, mfg)

}

class OaepPaddingHashAlgorithmInstance extends OaepPaddingAlgorithmInstance,

Crypto::HashAlgorithmInstance instanceof CipherStringLiteral

{

string hashName;

OaepPaddingHashAlgorithmInstance() {

oaep_padding_string_components(super.getPadding(), hashName, _)

}

override string getRawHashAlgorithmName() { result = super.getPadding() }

override Crypto::THashType getHashType() { result = hash_name_to_type_known(hashName, _) }

override int getFixedDigestLength() { exists(hash_name_to_type_known(hashName, result)) }

}

class OaepPaddingAlgorithmInstance extends Crypto::OaepPaddingAlgorithmInstance,

CipherStringLiteralPaddingAlgorithmInstance

{

override Crypto::HashAlgorithmInstance getOaepEncodingHashAlgorithm() { result = this }

override Crypto::HashAlgorithmInstance getMgf1HashAlgorithm() { none() } // TODO

}

/**

* The cipher algorithm argument to a `CipherGetInstanceCall`.

*

* For example, in `Cipher.getInstance(algorithm)`, this class represents `algorithm`.

*/

class CipherGetInstanceAlgorithmArg extends CipherAlgorithmValueConsumer instanceof Expr {

CipherGetInstanceAlgorithmArg() { this = any(CipherGetInstanceCall call).getAlgorithmArg() }

override Crypto::ConsumerInputDataFlowNode getInputNode() { result.asExpr() = this }

override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {

result.(CipherStringLiteralAlgorithmInstance).getConsumer() = this

}

}

/**

* An access to the `javax.crypto.Cipher` class.

*/

private class CipherAccess extends TypeAccess {

CipherAccess() {

this.getType().(Class).hasQualifiedName(javaxOrJakarta() + ".crypto", "Cipher")

}

}

/**

* An access to a cipher mode field of the `javax.crypto.Cipher` class,

* specifically `ENCRYPT_MODE`, `DECRYPT_MODE`, `WRAP_MODE`, or `UNWRAP_MODE`.

*/

private class JavaxCryptoCipherOperationModeAccess extends FieldAccess {

JavaxCryptoCipherOperationModeAccess() {

this.getQualifier() instanceof CipherAccess and

this.getField().getName().toUpperCase() in [

"ENCRYPT_MODE", "DECRYPT_MODE", "WRAP_MODE", "UNWRAP_MODE"

]

}

}

signature class GetInstanceCallSig instanceof MethodCall;

signature class InitCallSig instanceof MethodCall;

signature class UseCallSig instanceof MethodCall {

/**

* Holds if the use is not a final use, such as an `update()` call before `doFinal()`

*/

predicate isIntermediate();

}

/**

* An generic analysis module for analyzing the `getInstance` to `initialize` to `doOperation` pattern in the JCA.

*

* For example:

* ```

* kpg = KeyPairGenerator.getInstance();

* kpg.initialize(...);

* kpg.generate(...);

* ```

*/

module GetInstanceInitUseFlowAnalysis<

GetInstanceCallSig GetInstance, InitCallSig Init, UseCallSig Use>

{

newtype TFlowState =

TUninitialized() or

TInitialized(Init call) or

TIntermediateUse(Use call)

abstract class InitFlowState extends TFlowState {

string toString() {

this = TUninitialized() and result = "Uninitialized"

or

this = TInitialized(_) and result = "Initialized"

// TODO: add intermediate use

}

}

class UninitializedFlowState extends InitFlowState, TUninitialized { }

class InitializedFlowState extends InitFlowState, TInitialized {

Init call;

DataFlow::Node node1;

DataFlow::Node node2;

InitializedFlowState() {

this = TInitialized(call) and

node2.asExpr() = call.(MethodCall).getQualifier() and

DataFlow::localFlowStep(node1, node2) and

node1 != node2

}

Init getInitCall() { result = call }

DataFlow::Node getFstNode() { result = node1 }

DataFlow::Node getSndNode() { result = node2 }

}

class IntermediateUseState extends InitFlowState, TIntermediateUse {

Use call;

DataFlow::Node node1;

DataFlow::Node node2;

IntermediateUseState() {

this = TIntermediateUse(call) and

call.isIntermediate() and

node1.asExpr() = call.(MethodCall).getQualifier() and

node2 = node1

}

Use getUseCall() { result = call }

DataFlow::Node getFstNode() { result = node1 }

DataFlow::Node getSndNode() { result = node2 }

}

module GetInstanceToInitToUseConfig implements DataFlow::StateConfigSig {

class FlowState = InitFlowState;

predicate isSource(DataFlow::Node src, FlowState state) {

state instanceof UninitializedFlowState and

src.asExpr() instanceof GetInstance

or

src = state.(InitializedFlowState).getSndNode()

or

src = state.(IntermediateUseState).getSndNode()

}

// TODO: document this, but this is intentional (avoid cross products?)

predicate isSink(DataFlow::Node sink, FlowState state) { none() }

predicate isSink(DataFlow::Node sink) {

exists(Init c | c.(MethodCall).getQualifier() = sink.asExpr())

or

exists(Use c | not c.isIntermediate() and c.(MethodCall).getQualifier() = sink.asExpr())

}

predicate isAdditionalFlowStep(

DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2

) {

state1 = state1 and

(

node1 = state2.(InitializedFlowState).getFstNode() and

node2 = state2.(InitializedFlowState).getSndNode()

or

node1 = state2.(IntermediateUseState).getFstNode() and

node2 = state2.(IntermediateUseState).getSndNode()

)

}

predicate isBarrier(DataFlow::Node node, FlowState state) {

exists(CipherInitCall call | node.asExpr() = call.getQualifier() |

state instanceof UninitializedFlowState

or

state.(InitializedFlowState).getInitCall() != call

)

}

}

module GetInstanceToInitToUseFlow = DataFlow::GlobalWithState<GetInstanceToInitToUseConfig>;

GetInstance getInstantiationFromUse(Use use, DataFlow::Node src, DataFlow::Node sink) {

src.asExpr() = result and

sink.asExpr() = use.(MethodCall).getQualifier() and

GetInstanceToInitToUseFlow::flow(src, sink)

}

GetInstance getInstantiationFromInit(Init init, DataFlow::Node src, DataFlow::Node sink) {

src.asExpr() = result and

sink.asExpr() = init.(MethodCall).getQualifier() and

GetInstanceToInitToUseFlow::flow(src, sink)

}

Init getInitFromUse(Use use, DataFlow::Node src, DataFlow::Node sink) {

src.asExpr() = result.(MethodCall).getQualifier() and

sink.asExpr() = use.(MethodCall).getQualifier() and

GetInstanceToInitToUseFlow::flow(src, sink)

}

predicate hasInit(Use use) { exists(getInitFromUse(use, _, _)) }

Use getAnIntermediateUseFromFinalUse(Use final, DataFlow::Node src, DataFlow::Node sink) {

not final.isIntermediate() and

result.isIntermediate() and

src.asExpr() = result.(MethodCall).getQualifier() and

sink.asExpr() = final.(MethodCall).getQualifier() and

GetInstanceToInitToUseFlow::flow(src, sink)

}

}

module CipherFlowAnalysisImpl =

GetInstanceInitUseFlowAnalysis<CipherGetInstanceCall, CipherInitCall, CipherOperationCall>;

module CipherFlow = CipherFlowAnalysisImpl::GetInstanceToInitToUseFlow;

Crypto::KeyOperationSubtype getKeyOperationSubtypeFromState(

CipherFlowAnalysisImpl::InitFlowState state

) {

state instanceof CipherFlowAnalysisImpl::UninitializedFlowState and

result = Crypto::TUnknownKeyOperationMode()

or

exists(CipherInitCall call | state = CipherFlowAnalysisImpl::TInitialized(call) |

result = call.getCipherOperationModeType()

)

}

class CipherOperationInstance extends Crypto::KeyOperationInstance instanceof CipherOperationCall {

CipherOperationInstance() { not this.isIntermediate() }

override Crypto::KeyOperationSubtype getKeyOperationSubtype() {

if CipherFlowAnalysisImpl::hasInit(this)

then result = CipherFlowAnalysisImpl::getInitFromUse(this, _, _).getCipherOperationModeType()

else result = Crypto::TUnknownKeyOperationMode()

}

CipherGetInstanceCall getInstantiationCall() {

result = CipherFlowAnalysisImpl::getInstantiationFromUse(this, _, _)

}

CipherInitCall getInitCall() { result = CipherFlowAnalysisImpl::getInitFromUse(this, _, _) }

override Crypto::ConsumerInputDataFlowNode getNonceConsumer() {

result.asExpr() = this.getInitCall().getNonceArg()

}

override Crypto::ConsumerInputDataFlowNode getInputConsumer() {

result = super.getMessageArg() or

result = CipherFlowAnalysisImpl::getAnIntermediateUseFromFinalUse(this, _, _).getMessageArg()

}

override Crypto::ConsumerInputDataFlowNode getKeyConsumer() {

result.asExpr() = this.getInitCall().getKeyArg()

}

override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {

result = this.getInstantiationCall().getAlgorithmArg()

}

override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {

result.asExpr() = super.getOutput()

}

}

/**

* Initialization vectors and other nonce artifacts

*/

abstract class NonceParameterInstantiation extends ClassInstanceExpr {

DataFlow::Node getOutputNode() { result.asExpr() = this }

abstract DataFlow::Node getInputNode();

}

// TODO: for all parametert specs, I think they can be set through the constructor

// and through setter methods

class IvParameterSpecInstance extends NonceParameterInstantiation {

IvParameterSpecInstance() {

super

.getConstructedType()

.hasQualifiedName(javaxOrJakarta() + ".crypto.spec", "IvParameterSpec")

}

override DataFlow::Node getInputNode() { result.asExpr() = super.getArgument(0) }

}

// TODO: this also specifies the tag length for GCM

class GCMParameterSpecInstance extends NonceParameterInstantiation {

GCMParameterSpecInstance() {

super

.getConstructedType()

.hasQualifiedName(javaxOrJakarta() + ".crypto.spec", "GCMParameterSpec")

}

override DataFlow::Node getInputNode() { result.asExpr() = super.getArgument(1) }

}

class IvParameterSpecGetIvCall extends MethodCall {

IvParameterSpecGetIvCall() {

this.getMethod()

.hasQualifiedName(javaxOrJakarta() + ".crypto.spec", "IvParameterSpec", "getIV")

}

}

class KeyAdditionalFlowSteps extends MethodCall {

KeyAdditionalFlowSteps() {

this.getCallee().hasQualifiedName("java.security", "KeyPair", "getPublic")

or

this.getCallee().hasQualifiedName("java.security", "KeyPair", "getPrivate")

or

this.getCallee().hasQualifiedName("java.security", "Key", "getEncoded")

}

DataFlow::Node getInputNode() { result.asExpr() = this.getQualifier() }

DataFlow::Node getOutputNode() { result.asExpr() = this }

}

predicate additionalFlowSteps(DataFlow::Node node1, DataFlow::Node node2) {

exists(IvParameterSpecGetIvCall m |

node1.asExpr() = m.getQualifier() and

node2.asExpr() = m

)

or

exists(NonceParameterInstantiation n |

node1 = n.getInputNode() and

node2 = n.getOutputNode()

)

or

exists(KeyAdditionalFlowSteps call |

node1 = call.getInputNode() and

node2 = call.getOutputNode()

)

}

class ArtifactAdditionalFlowStep extends AdditionalFlowInputStep {

DataFlow::Node output;

ArtifactAdditionalFlowStep() { additionalFlowSteps(this, output) }

override DataFlow::Node getOutput() { result = output }

}

/**

* A data-flow configuration to track flow from a mode field access to

* the mode argument of the `init` method of the `javax.crypto.Cipher` class.

*/

private module JavaxCipherModeAccessToInitConfig implements DataFlow::ConfigSig {

predicate isSource(DataFlow::Node src) {

src.asExpr() instanceof JavaxCryptoCipherOperationModeAccess

}

predicate isSink(DataFlow::Node sink) {

exists(CipherInitCall c | c.getModeArg() = sink.asExpr())

}

}

module JavaxCipherModeAccessToInitFlow = DataFlow::Global<JavaxCipherModeAccessToInitConfig>;

private predicate cipher_mode_str_to_cipher_mode_known(

string mode, Crypto::KeyOperationSubtype cipher_mode

) {

mode = "ENCRYPT_MODE" and cipher_mode = Crypto::TEncryptMode()

or

mode = "WRAP_MODE" and cipher_mode = Crypto::TWrapMode()

or

mode = "DECRYPT_MODE" and cipher_mode = Crypto::TDecryptMode()

or

mode = "UNWRAP_MODE" and cipher_mode = Crypto::TUnwrapMode()

}

class CipherInitCall extends MethodCall {

CipherInitCall() {

this.getCallee().hasQualifiedName(javaxOrJakarta() + ".crypto", "Cipher", "init")

}

/**

* Returns the mode argument to the `init` method

* that is used to determine the cipher operation mode.

* Note this is the raw expr and not necessarily a direct access

* of a mode. Use `getModeOrigin()` to get the field access origin

* flowing to this argument, if one exists (is known).

*/

Expr getModeArg() { result = this.getArgument(0) }

JavaxCryptoCipherOperationModeAccess getModeOrigin() {

exists(DataFlow::Node src, DataFlow::Node sink |

JavaxCipherModeAccessToInitFlow::flow(src, sink) and

src.asExpr() = result and

this.getModeArg() = sink.asExpr()

)

}

Crypto::KeyOperationSubtype getCipherOperationModeType() {

if cipher_mode_str_to_cipher_mode_known(this.getModeOrigin().getField().getName(), _)

then cipher_mode_str_to_cipher_mode_known(this.getModeOrigin().getField().getName(), result)

else result = Crypto::TUnknownKeyOperationMode()

}

Expr getKeyArg() {

result = this.getArgument(1) and this.getMethod().getParameterType(1).hasName("Key")

}

Expr getNonceArg() {

result = this.getArgument(2) and

this.getMethod().getParameterType(2).hasName("AlgorithmParameterSpec")

}

}

class CipherInitCallKeyConsumer extends Crypto::ArtifactConsumer {

CipherInitCallKeyConsumer() { this = any(CipherInitCall call).getKeyArg() }

override Crypto::ConsumerInputDataFlowNode getInputNode() { result.asExpr() = this }

}

/*

* Hash Functions

*/

/**

* Flow from a known hash algorithm name to a `MessageDigest.getInstance(sink)` call.

*/

module KnownHashAlgorithmLiteralToMessageDigestConfig implements DataFlow::ConfigSig {

predicate isSource(DataFlow::Node src) { hash_names(src.asExpr().(JavaConstant).getValue()) }

predicate isSink(DataFlow::Node sink) {

exists(HashAlgorithmValueConsumer consumer | sink = consumer.getInputNode())

}

}

module KnownHashAlgorithmLiteralToMessageDigestFlow =

DataFlow::Global<KnownHashAlgorithmLiteralToMessageDigestConfig>;

class KnownHashAlgorithm extends Crypto::HashAlgorithmInstance instanceof JavaConstant {

HashAlgorithmValueConsumer consumer;

KnownHashAlgorithm() {

hash_names(super.getValue()) and

KnownHashAlgorithmLiteralToMessageDigestFlow::flow(DataFlow::exprNode(this),

consumer.getInputNode())

}

HashAlgorithmValueConsumer getConsumer() { result = consumer }

override string getRawHashAlgorithmName() { result = super.getValue() }

override Crypto::THashType getHashType() {

result = hash_name_to_type_known(this.getRawHashAlgorithmName(), _)

}

override int getFixedDigestLength() {

exists(hash_name_to_type_known(this.getRawHashAlgorithmName(), result))

}

}

module MessageDigestFlowAnalysisImpl =

GetInstanceInitUseFlowAnalysis<MessageDigestGetInstanceCall, DUMMY_UNUSED_METHODCALL, DigestCall>;

class MessageDigestGetInstanceAlgorithmValueConsumer extends HashAlgorithmValueConsumer {

MessageDigestGetInstanceCall call;

MessageDigestGetInstanceAlgorithmValueConsumer() { this = call.getAlgorithmArg() }

MessageDigestGetInstanceCall getInstantiationCall() { result = call }

override Crypto::ConsumerInputDataFlowNode getInputNode() { result.asExpr() = this }

override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {

exists(KnownHashAlgorithm l | l.getConsumer() = this and result = l)

}

}

class MessageDigestGetInstanceCall extends MethodCall {

MessageDigestGetInstanceCall() {

this.getCallee().hasQualifiedName("java.security", "MessageDigest", "getInstance")

}

Expr getAlgorithmArg() { result = this.getArgument(0) }

}

class DigestCall extends MethodCall {

DigestCall() {

this.getCallee().hasQualifiedName("java.security", "MessageDigest", ["update", "digest"])

}

Expr getDigestArtifactOutput() { result = this }

Expr getInputArg() { result = this.getArgument(0) }

predicate isIntermediate() { this.getMethod().getName() = "update" }

}

// flow config from MessageDigest.getInstance to MessageDigest.digest

module DigestGetInstanceToDigestConfig implements DataFlow::ConfigSig {

predicate isSource(DataFlow::Node src) { src.asExpr() instanceof MessageDigestGetInstanceCall }

predicate isSink(DataFlow::Node sink) {

exists(DigestCall c | c.getQualifier() = sink.asExpr())

}

}

module DigestGetInstanceToDigestFlow = DataFlow::Global<DigestGetInstanceToDigestConfig>;

class DigestHashOperation extends Crypto::HashOperationInstance instanceof DigestCall {

DigestHashOperation() { not super.isIntermediate() }

override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {

result.asExpr() = super.getDigestArtifactOutput()

}

override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {

MessageDigestFlowAnalysisImpl::getInstantiationFromUse(this, _, _) =

result.(MessageDigestGetInstanceAlgorithmValueConsumer).getInstantiationCall()

}

override Crypto::ConsumerInputDataFlowNode getInputConsumer() {

result.asExpr() = super.getInputArg() or

result.asExpr() =

MessageDigestFlowAnalysisImpl::getAnIntermediateUseFromFinalUse(this, _, _).getInputArg()

}

}

/*

* Key Generation

*/

module KeyGeneratorFlowAnalysisImpl =

GetInstanceInitUseFlowAnalysis<KeyGeneratorGetInstanceCall, KeyGeneratorInitCall,

KeyGeneratorGenerateCall>;

module KeyGeneratorFlow = KeyGeneratorFlowAnalysisImpl::GetInstanceToInitToUseFlow;

abstract class KeyGeneratorParameterSpecClassInstanceExpr extends ClassInstanceExpr {

KeyGeneratorInitCall getAnInitCallUse() {

exists(DataFlow::Node sink |

KeyGeneratorParameterSpecToInitializeFlow::flow(DataFlow::exprNode(this), sink) and

result.getAlgorithmParameterSpecArg() = sink.asExpr()

)

}

}

class DHGenParameterSpecInstance extends KeyGeneratorParameterSpecClassInstanceExpr {

DHGenParameterSpecInstance() {

super

.getConstructedType()

.hasQualifiedName(javaxOrJakarta() + ".crypto.spec", "DHGenParameterSpec")

}

Expr getPrimeSizeArg() { result = this.getArgument(0) }

Expr getExponentSizeArg() { result = this.getArgument(1) }

}

class DSAParameterSpecInstance extends KeyGeneratorParameterSpecClassInstanceExpr {

DSAParameterSpecInstance() {

super.getConstructedType().hasQualifiedName("java.security.spec", "DSAParameterSpec")

}

Expr getPArg() { result = this.getArgument(0) }

Expr getQArg() { result = this.getArgument(1) }

Expr getSeedLenArg() { result = this.getArgument(2) }

}