Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e64825f

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
fix code-scanning bot problems
1 parent b6a8c27 commit e64825f

4 files changed

Lines changed: 22 additions & 67 deletions

File tree

‎java/ql/lib/semmle/code/java/security/InsufficientKeySizeQuery.qll‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
1+
/** Provides classes and predicates related to insufficient key sizes in Java. */
2+
13
import semmle.code.java.security.Encryption
24
import semmle.code.java.dataflow.DataFlow
35
import semmle.code.java.dataflow.DataFlow2
46

57
/**
6-
* Asymmetric (RSA, DSA, DH) key length data flow tracking configuration.
8+
* An Asymmetric (RSA, DSA, DH) key length data flow tracking configuration.
79
*/
810
class AsymmetricNonECKeyTrackingConfiguration extends DataFlow2::Configuration {
911
AsymmetricNonECKeyTrackingConfiguration() { this = "AsymmetricNonECKeyTrackingConfiguration" }
@@ -29,24 +31,24 @@ class AsymmetricNonECKeyTrackingConfiguration extends DataFlow2::Configuration {
2931
or
3032
// TODO: combine below three for less duplicated code
3133
exists(ClassInstanceExpr rsaKeyGenParamSpec |
32-
rsaKeyGenParamSpec.getConstructedType() instanceof RSAKeyGenParameterSpec and
34+
rsaKeyGenParamSpec.getConstructedType() instanceof RsaKeyGenParameterSpec and
3335
sink.asExpr() = rsaKeyGenParamSpec.getArgument(0)
3436
)
3537
or
3638
exists(ClassInstanceExpr dsaGenParamSpec |
37-
dsaGenParamSpec.getConstructedType() instanceof DSAGenParameterSpec and
39+
dsaGenParamSpec.getConstructedType() instanceof DsaGenParameterSpec and
3840
sink.asExpr() = dsaGenParamSpec.getArgument(0)
3941
)
4042
or
4143
exists(ClassInstanceExpr dhGenParamSpec |
42-
dhGenParamSpec.getConstructedType() instanceof DHGenParameterSpec and
44+
dhGenParamSpec.getConstructedType() instanceof DhGenParameterSpec and
4345
sink.asExpr() = dhGenParamSpec.getArgument(0)
4446
)
4547
}
4648
}
4749

4850
/**
49-
* Asymmetric (EC) key length data flow tracking configuration.
51+
* An Asymmetric (EC) key length data flow tracking configuration.
5052
*/
5153
class AsymmetricECKeyTrackingConfiguration extends DataFlow2::Configuration {
5254
AsymmetricECKeyTrackingConfiguration() { this = "AsymmetricECKeyTrackingConfiguration" }
@@ -72,15 +74,15 @@ class AsymmetricECKeyTrackingConfiguration extends DataFlow2::Configuration {
7274
)
7375
or
7476
exists(ClassInstanceExpr ecGenParamSpec |
75-
ecGenParamSpec.getConstructedType() instanceof ECGenParameterSpec and
77+
ecGenParamSpec.getConstructedType() instanceof EcGenParameterSpec and
7678
//getECKeySize(ecGenParamSpec.getArgument(0).(StringLiteral).getValue()) < 256 and
7779
sink.asExpr() = ecGenParamSpec.getArgument(0)
7880
)
7981
}
8082
}
8183

8284
/**
83-
* Symmetric (AES) key length data flow tracking configuration.
85+
* A Symmetric (AES) key length data flow tracking configuration.
8486
*/
8587
class SymmetricKeyTrackingConfiguration extends DataFlow2::Configuration {
8688
SymmetricKeyTrackingConfiguration() { this = "SymmetricKeyTrackingConfiguration" }
@@ -96,7 +98,7 @@ class SymmetricKeyTrackingConfiguration extends DataFlow2::Configuration {
9698
JavaxCryptoKeyGenerator jcg, KeyGeneratorInitConfiguration kgConfig,
9799
DataFlow::PathNode source, DataFlow::PathNode dest
98100
|
99-
jcg.getAlgoSpec().(StringLiteral).getValue().toUpperCase().matches("AES") and
101+
jcg.getAlgoSpec().(StringLiteral).getValue().toUpperCase() = "AES" and
100102
source.getNode().asExpr() = jcg and
101103
dest.getNode().asExpr() = ma.getQualifier() and
102104
kgConfig.hasFlowPath(source, dest)
@@ -108,7 +110,7 @@ class SymmetricKeyTrackingConfiguration extends DataFlow2::Configuration {
108110

109111
// ********************** Need the below models for the above configs **********************
110112
// todo: move some/all of below to Encryption.qll or elsewhere?
111-
/** Data flow configuration tracking flow from a key generator to an `init` method call. */
113+
/** A data flow configuration tracking flow from a key generator to an `init` method call. */
112114
private class KeyGeneratorInitConfiguration extends DataFlow::Configuration {
113115
KeyGeneratorInitConfiguration() { this = "KeyGeneratorInitConfiguration" }
114116

@@ -124,7 +126,7 @@ private class KeyGeneratorInitConfiguration extends DataFlow::Configuration {
124126
}
125127
}
126128

127-
/** Data flow configuration tracking flow from a keypair generator to an `initialize` method call. */
129+
/** A data flow configuration tracking flow from a keypair generator to an `initialize` method call. */
128130
private class KeyPairGeneratorInitConfiguration extends DataFlow::Configuration {
129131
KeyPairGeneratorInitConfiguration() { this = "KeyPairGeneratorInitConfiguration" }
130132

@@ -141,23 +143,23 @@ private class KeyPairGeneratorInitConfiguration extends DataFlow::Configuration
141143
}
142144

143145
/** The Java class `java.security.spec.ECGenParameterSpec`. */
144-
private class ECGenParameterSpec extends RefType {
145-
ECGenParameterSpec() { this.hasQualifiedName("java.security.spec", "ECGenParameterSpec") }
146+
private class EcGenParameterSpec extends RefType {
147+
EcGenParameterSpec() { this.hasQualifiedName("java.security.spec", "ECGenParameterSpec") }
146148
}
147149

148150
/** The Java class `java.security.spec.RSAKeyGenParameterSpec`. */
149-
private class RSAKeyGenParameterSpec extends RefType {
150-
RSAKeyGenParameterSpec() { this.hasQualifiedName("java.security.spec", "RSAKeyGenParameterSpec") }
151+
private class RsaKeyGenParameterSpec extends RefType {
152+
RsaKeyGenParameterSpec() { this.hasQualifiedName("java.security.spec", "RSAKeyGenParameterSpec") }
151153
}
152154

153155
/** The Java class `java.security.spec.DSAGenParameterSpec`. */
154-
private class DSAGenParameterSpec extends RefType {
155-
DSAGenParameterSpec() { this.hasQualifiedName("java.security.spec", "DSAGenParameterSpec") }
156+
private class DsaGenParameterSpec extends RefType {
157+
DsaGenParameterSpec() { this.hasQualifiedName("java.security.spec", "DSAGenParameterSpec") }
156158
}
157159

158160
/** The Java class `javax.crypto.spec.DHGenParameterSpec`. */
159-
private class DHGenParameterSpec extends RefType {
160-
DHGenParameterSpec() { this.hasQualifiedName("javax.crypto.spec", "DHGenParameterSpec") }
161+
private class DhGenParameterSpec extends RefType {
162+
DhGenParameterSpec() { this.hasQualifiedName("javax.crypto.spec", "DHGenParameterSpec") }
161163
}
162164

163165
/** The `init` method declared in `javax.crypto.KeyGenerator`. */
@@ -190,6 +192,7 @@ private int getECKeySize(string algorithm) {
190192
}
191193
// ******* DATAFLOW ABOVE *************************************************************************
192194
// TODO:
195+
// todo #0: look into use of specs without keygens; should spec not be a sink in these cases?
193196
// todo #1: make representation of source that can be shared across the configs
194197
// todo #2: make representation of sink that can be shared across the configs
195198
// todo #3: make list of algo names more easily reusable (either as constant-type variable at top of file, or model as own class to share, etc.)

‎java/ql/src/Security/CWE/CWE-326/InsufficientKeySize.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,4 @@ where
1919
exists(AsymmetricNonECKeyTrackingConfiguration config1 | config1.hasFlow(source, sink)) or
2020
exists(AsymmetricECKeyTrackingConfiguration config2 | config2.hasFlow(source, sink)) or
2121
exists(SymmetricKeyTrackingConfiguration config3 | config3.hasFlow(source, sink))
22-
select sink, "This $@ is too small and creates a key $@.", source, "key size", sink, "here"
22+
select sink, "This $@ is too small.", source, "key size"

‎java/ql/src/Security/CWE/CWE-326/InsufficientKeySize_OLD.java‎

Lines changed: 0 additions & 37 deletions
This file was deleted.

‎java/ql/test/query-tests/security/CWE-326/InsufficientKeySizeTestOLD.txt‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

0 commit comments

Comments
 (0)