Java/BrokenCryptoAlgorithmQuery

d10c · d10c · commit b023880a0a1d · 2025-10-28T09:39:37.000+01:00
java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
diff --git a/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll b/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll
@@ -36,6 +36,8 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.getLocation()
+    or
     exists(CryptoAlgoSpec c | sink.asExpr() = c.getAlgoSpec() | result = c.getLocation())
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -36,6 +36,8 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {`
`36`	`36`	`predicate observeDiffInformedIncrementalMode() { any() }`
`37`	`37`
`38`	`38`	`Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`39`	`+ result = sink.getLocation()`
	`40`	`+ or`
`39`	`41`	`exists(CryptoAlgoSpec c \| sink.asExpr() = c.getAlgoSpec() \| result = c.getLocation())`
`40`	`42`	`}`
`41`	`43`	`}`