Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8d7b275

Browse files
owen-mcowen-mc
committed
Add query help examples
1 parent 69ecdcb commit 8d7b275

5 files changed

Lines changed: 62 additions & 62 deletions

File tree

‎go/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@
2828
<example>
2929

3030
<p>
31-
The following code uses the different packages to encrypt/hash
32-
some secret data. The first few examples uses DES, MD5, RC4, and SHA1,
33-
which are older algorithms that are now considered weak. The following
34-
examples use AES and SHA256, which are stronger, more modern algorithms.
31+
The following code uses the different packages to encrypt
32+
some secret data. The first example uses DES,
33+
which is an older algorithm that is now considered weak. The following
34+
example uses AES, which is a stronger, more modern algorithm.
3535
</p>
3636

3737
<sample src="examples/Crypto.go" />

‎go/ql/src/Security/CWE-327/WeakSensitiveDataHashing.qhelp‎

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -65,35 +65,28 @@
6565

6666
<p>
6767
The following example shows two functions for checking whether the hash
68-
of a certificate matches a known value -- to prevent tampering.
68+
of a secret matches a known value.
6969

70-
The first function uses MD5 that is known to be vulnerable to collision attacks.
70+
The first function uses SHA-1 that is known to be vulnerable to collision attacks.
7171

7272
The second function uses SHA-256 that is a strong cryptographic hashing function.
7373
</p>
7474

75-
<sample src="examples/weak_certificate_hashing.rb" />
75+
<sample src="examples/WeakSecretHashing.go" />
7676

7777
</example>
7878
<example>
7979
<p>
8080
The following example shows two functions for hashing passwords.
8181

82-
The first function uses SHA-256 to hash passwords. Although SHA-256 is a
83-
strong cryptographic hash function, it is not suitable for password
82+
The first example uses SHA-256 to hash passwords. Although
83+
SHA-256 is a strong cryptographic hash function, it is not suitable for password
8484
hashing since it is not computationally expensive.
85-
</p>
86-
87-
<sample src="examples/weak_password_hashing_bad.rb" />
8885

89-
90-
<p>
91-
The second function uses Argon2 (through the <code>argon2</code>
92-
gem), which is a strong password hashing algorithm (and
93-
includes a per-password salt by default).
86+
The second function uses PBKDF2, which is a strong password hashing algorithm.
9487
</p>
9588

96-
<sample src="examples/weak_password_hashing_good.rb" />
89+
<sample src="examples/WeakPasswordHashing.go" />
9790

9891
</example>
9992

‎go/ql/src/Security/CWE-327/examples/Crypto.go‎

Lines changed: 11 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -3,51 +3,18 @@ package main
33
import (
44
"crypto/aes"
55
"crypto/des"
6-
"crypto/md5"
7-
"crypto/rc4"
8-
"crypto/sha1"
9-
"crypto/sha256"
106
)
117

12-
func main() {
13-
public := []byte("hello")
14-
15-
password := []byte("123456")
16-
buf := password // testing dataflow by passing into different variable
17-
18-
// BAD, des is a weak crypto algorithm and password is sensitive data
19-
des.NewTripleDESCipher(buf)
20-
21-
// BAD, md5 is a weak crypto algorithm and password is sensitive data
22-
md5.Sum(buf)
23-
24-
// BAD, rc4 is a weak crypto algorithm and password is sensitive data
25-
rc4.NewCipher(buf)
26-
27-
// BAD, sha1 is a weak crypto algorithm and password is sensitive data
28-
sha1.Sum(buf)
29-
30-
// GOOD, password is sensitive data but aes is a strong crypto algorithm
31-
aes.NewCipher(buf)
32-
33-
// GOOD, password is sensitive data but sha256 is a strong crypto algorithm
34-
sha256.Sum256(buf)
35-
36-
// GOOD, des is a weak crypto algorithm but public is not sensitive data
37-
des.NewTripleDESCipher(public)
38-
39-
// GOOD, md5 is a weak crypto algorithm but public is not sensitive data
40-
md5.Sum(public)
41-
42-
// GOOD, rc4 is a weak crypto algorithm but public is not sensitive data
43-
rc4.NewCipher(public)
44-
45-
// GOOD, sha1 is a weak crypto algorithm but public is not sensitive data
46-
sha1.Sum(public)
47-
48-
// GOOD, aes is a strong crypto algorithm and public is not sensitive data
49-
aes.NewCipher(public)
8+
func EncryptMessageWeak(key []byte, message []byte) (dst []byte) {
9+
// BAD, DES is a weak crypto algorithm
10+
block, _ := des.NewCipher(key)
11+
block.Encrypt(dst, message)
12+
return
13+
}
5014

51-
// GOOD, sha256 is a strong crypto algorithm and public is not sensitive data
52-
sha256.Sum256(public)
15+
func EncryptMessageStrong(key []byte, message []byte) (dst []byte) {
16+
// GOOD, AES is a weak crypto algorithm
17+
block, _ := aes.NewCipher(key)
18+
block.Encrypt(dst, message)
19+
return
5320
}

‎go/ql/src/Security/CWE-327/examples/WeakPasswordHashing.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
package main
2+
3+
import (
4+
"crypto/pbkdf2"
5+
"crypto/rand"
6+
"crypto/sha256"
7+
"crypto/sha512"
8+
)
9+
10+
func GetPasswordHashBad(password string) [32]byte {
11+
// BAD, SHA256 is a strong hashing algorithm but it is not computationally expensive
12+
return sha256.Sum256([]byte(password))
13+
}
14+
15+
func GetPasswordHashGood(password string) []byte {
16+
// GOOD, PBKDF2 is a strong hashing algorithm and it is computationally expensive
17+
salt := make([]byte, 16)
18+
rand.Read(salt)
19+
key, _ := pbkdf2.Key(sha512.New, password, salt, 4096, 32)
20+
return key
21+
}

‎go/ql/src/Security/CWE-327/examples/WeakSecretHashing.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package main
2+
3+
import (
4+
"crypto/sha1"
5+
"crypto/sha256"
6+
"slices"
7+
)
8+
9+
func SecretMatchesKnownHashBad(secret []byte, known_hash []byte) bool {
10+
// BAD, SHA1 is a weak crypto algorithm and secret is sensitive data
11+
h := sha1.New()
12+
return slices.Equal(h.Sum(secret), known_hash)
13+
}
14+
15+
func SecretMatchesKnownHashGood(secret []byte, known_hash []byte) bool {
16+
// GOOD, SHA256 is a strong hashing algorithm
17+
h := sha256.New()
18+
return slices.Equal(h.Sum(secret), known_hash)
19+
}

0 commit comments

Comments
 (0)