Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 98f4c29

Browse files
aibaarsaibaars
committed
Ruby: weak crypto: do not report weak hash algorithms
Weak hash algorithms such as MD5 and SHA1 are often used in non security sensitive contexts and reporting all uses is far too noisy.
1 parent 265838a commit 98f4c29

File tree

4 files changed

+19
-21
lines changed

4 files changed

+19
-21
lines changed

‎ruby/ql/src/change-notes/2022-11-04-weak-crypto-hash.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The `rb/weak-cryptographic-algorithm` has been updated to no longer report uses of hash functions such as `MD5` and `SHA1` even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice.

‎ruby/ql/src/queries/security/cwe-327/BrokenCryptoAlgorithm.ql

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,12 @@ import codeql.ruby.Concepts
1515

1616
from Cryptography::CryptographicOperation operation, string msgPrefix
1717
where
18-
operation.getAlgorithm().isWeak() and
19-
msgPrefix = "The cryptographic algorithm " + operation.getAlgorithm().getName()
18+
exists(Cryptography::CryptographicAlgorithm algorithm |
19+
algorithm = operation.getAlgorithm() and
20+
algorithm.isWeak() and
21+
msgPrefix = "The cryptographic algorithm " + algorithm.getName() and
22+
not algorithm instanceof Cryptography::HashingAlgorithm
23+
)
2024
or
2125
operation.getBlockMode().isWeak() and msgPrefix = "The block mode " + operation.getBlockMode()
2226
select operation, msgPrefix + " is broken or weak, and should not be used."

‎ruby/ql/test/query-tests/security/cwe-327/BrokenCryptoAlgorithm.expected

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,3 @@
1717
| broken_crypto.rb:75:1:75:24 | call to new | The cryptographic algorithm RC4 is broken or weak, and should not be used. |
1818
| broken_crypto.rb:77:1:77:29 | call to new | The cryptographic algorithm RC4 is broken or weak, and should not be used. |
1919
| broken_crypto.rb:79:1:79:35 | call to new | The cryptographic algorithm RC4 is broken or weak, and should not be used. |
20-
| broken_crypto.rb:81:1:81:28 | call to hexdigest | The cryptographic algorithm MD5 is broken or weak, and should not be used. |
21-
| broken_crypto.rb:84:1:84:31 | call to base64digest | The cryptographic algorithm MD5 is broken or weak, and should not be used. |
22-
| broken_crypto.rb:87:1:87:20 | call to digest | The cryptographic algorithm MD5 is broken or weak, and should not be used. |
23-
| broken_crypto.rb:89:1:89:21 | call to update | The cryptographic algorithm MD5 is broken or weak, and should not be used. |
24-
| broken_crypto.rb:90:1:90:17 | ... << ... | The cryptographic algorithm MD5 is broken or weak, and should not be used. |
25-
| broken_crypto.rb:95:1:95:34 | call to bubblebabble | The cryptographic algorithm MD5 is broken or weak, and should not be used. |
26-
| broken_crypto.rb:97:11:97:37 | call to file | The cryptographic algorithm MD5 is broken or weak, and should not be used. |
27-
| broken_crypto.rb:103:1:103:21 | call to digest | The cryptographic algorithm SHA1 is broken or weak, and should not be used. |
28-
| broken_crypto.rb:104:1:104:17 | ... << ... | The cryptographic algorithm SHA1 is broken or weak, and should not be used. |
29-
| broken_crypto.rb:106:1:106:37 | call to digest | The cryptographic algorithm SHA1 is broken or weak, and should not be used. |

‎ruby/ql/test/query-tests/security/cwe-327/broken_crypto.rb

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -78,30 +78,30 @@
7878
# BAD: weak encryption algorithm
7979
OpenSSL::Cipher::RC4.new 'hmac-md5'
8080

81-
Digest::MD5.hexdigest('foo') # BAD: weak hash algorithm
81+
Digest::MD5.hexdigest('foo') # OK: don't report hash algorithm even if it is weak
8282
Digest::SHA256.hexdigest('foo') # GOOD: strong hash algorithm
8383

84-
Digest::MD5.base64digest('foo') # BAD: weak hash algorithm
84+
Digest::MD5.base64digest('foo') # OK: don't report hash algorithm even if it is weak
8585

8686
md5 = Digest::MD5.new
87-
md5.digest 'message' # BAD: weak hash algorithm
87+
md5.digest 'message' # OK: don't report hash algorithm even if it is weak
8888

89-
md5.update 'message1' # BAD: weak hash algorithm
89+
md5.update 'message1' # # OK: don't report hash algorithm even if it is weak
9090
md5 << 'message2' # << is an alias for update
9191

9292
sha256 = Digest::SHA256.new
9393
sha256.digest 'message' # GOOD: strong hash algorithm
9494

95-
Digest::MD5.bubblebabble 'message' # BAD: weak hash algorithm
95+
Digest::MD5.bubblebabble 'message' # OK: don't report hash algorithm even if it is weak
9696

97-
filemd5 = Digest::MD5.file 'testfile'
97+
filemd5 = Digest::MD5.file 'testfile' # OK: don't report hash algorithm even if it is weak
9898
filemd5.hexdigest
9999

100-
Digest("MD5").hexdigest('foo') # BAD: weak hash algorithm
100+
Digest("MD5").hexdigest('foo') # OK: don't report hash algorithm even if it is weak
101101

102102
sha1 = OpenSSL::Digest.new('SHA1')
103-
sha1.digest 'message' # BAD: weak hash algorithm
103+
sha1.digest 'message' # OK: don't report hash algorithm even if it is weak
104104
sha1 << 'message' # << is an alias for update
105105

106-
OpenSSL::Digest.digest('SHA1', "abc") # BAD: weak hash algorithm
106+
OpenSSL::Digest.digest('SHA1', "abc") # OK: don't report hash algorithm even if it is weak
107107
OpenSSL::Digest.digest('SHA3-512', "abc") # GOOD: strong hash algorithm

0 commit comments

Comments
 (0)