add draft code to find algo type to replace tainttracking configs

Jami Cogswell · Jami Cogswell · commit 8ffd2522e79a · 2022-10-11T16:56:10.000-04:00
diff --git a/java/ql/lib/semmle/code/java/security/Encryption.qll b/java/ql/lib/semmle/code/java/security/Encryption.qll
@@ -252,6 +252,7 @@ string getASecureAlgorithmName() {
       "Blowfish", "ECIES" // ! Blowfish not actually secure based on https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-4426 ??
       // ! hmm, other sources imply that it is secure...
       // ! also no DH here, etc.?
+      // ! also is ECB matched with AES?
     ]
 }
 
diff --git a/java/ql/lib/semmle/code/java/security/InsufficientKeySizeQuery.qll b/java/ql/lib/semmle/code/java/security/InsufficientKeySizeQuery.qll
@@ -155,6 +155,26 @@ private predicate hasShortAESKey(MethodAccess ma, string msg) {
 bindingset[type]
 private predicate hasShortAsymmetricKeyPair(MethodAccess ma, string msg, string type) {
   ma.getMethod() instanceof KeyPairGeneratorInitMethod and
+  ma.getQualifier() instanceof JavaSecurityKeyPairGenerator and
+  ma.getQualifier().getBasicBlock() instanceof JavaSecurityKeyPairGenerator and
+  //ma.getQualifier().getBasicBlock().getNode(2) instanceof JavaSecurityKeyPairGenerator and
+  // ma.getQualifier()
+  //     .getBasicBlock()
+  //     .getANode()
+  //     .(JavaSecurityKeyPairGenerator)
+  //     .getAlgoSpec()
+  //     .(StringLiteral)
+  //     .getValue()
+  //     .toUpperCase() = type and
+  //ma.getQualifier().getBasicBlock().getAPredecessor() instanceof JavaSecurityKeyPairGenerator and
+  ma.getQualifier()
+      .getBasicBlock()
+      .getAPredecessor()
+      .(JavaSecurityKeyPairGenerator)
+      .getAlgoSpec()
+      .(StringLiteral)
+      .getValue()
+      .toUpperCase() = type and
   // flow needed to correctly determine algorithm type and
   // not match to ANY asymmetric algorithm
   exists(
diff --git a/java/ql/src/Security/CWE/CWE-326/InsufficientKeySize.ql b/java/ql/src/Security/CWE/CWE-326/InsufficientKeySize.ql
@@ -4,6 +4,7 @@
  *              allow an attacker to compromise security.
  * @kind path-problem
  * @problem.severity error
+ * @security-severity 7.5
  * @precision high
  * @id java/insufficient-key-size
  * @tags security
@@ -12,10 +13,12 @@
 
 import java
 import semmle.code.java.security.InsufficientKeySizeQuery
+import DataFlow::PathGraph
 
 // from Expr e, string msg
 // where hasInsufficientKeySize(e, msg)
 // select e, msg
 from AsymmetricKeyTrackingConfiguration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink, source, sink, "The size of this RSA key should be at least 2048 bits."
+select sink.getNode(), source, sink, "The $@ of an asymmetric key should be at least 2048 bits.",
+  sink.getNode(), "size"
diff --git a/java/ql/test/query-tests/security/CWE-326/InsufficientKeySizeTest.java b/java/ql/test/query-tests/security/CWE-326/InsufficientKeySizeTest.java
@@ -106,7 +106,7 @@ public void cryptoMethod() throws java.security.NoSuchAlgorithmException, java.s
         test(keysize);
     }
 
-    public void test(int keySize) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
+    public static void test(int keySize) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
         KeyPairGenerator keyPairGen19 = KeyPairGenerator.getInstance("RSA");
         // BAD: Key size is less than 128
         keyPairGen19.initialize(keySize); // $ hasInsufficientKeySize

Original file line number	Diff line number	Diff line change
`@@ -252,6 +252,7 @@ string getASecureAlgorithmName() {`
`252`	`252`	`"Blowfish", "ECIES" // ! Blowfish not actually secure based on https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-4426 ??`
`253`	`253`	`// ! hmm, other sources imply that it is secure...`
`254`	`254`	`// ! also no DH here, etc.?`
	`255`	`+ // ! also is ECB matched with AES?`
`255`	`256`	`]`
`256`	`257`	`}`
`257`	`258`
Original file line number	Diff line number	Diff line change
`@@ -106,7 +106,7 @@ public void cryptoMethod() throws java.security.NoSuchAlgorithmException, java.s`
`106`	`106`	`test(keysize);`
`107`	`107`	`}`
`108`	`108`
`109`		`- public void test(int keySize) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {`
	`109`	`+ public static void test(int keySize) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {`
`110`	`110`	`KeyPairGenerator keyPairGen19 = KeyPairGenerator.getInstance("RSA");`
`111`	`111`	`// BAD: Key size is less than 128`
`112`	`112`	`keyPairGen19.initialize(keySize); // $ hasInsufficientKeySize`