Skip to content

Commit 033bad0

Browse files
ESS-ENNESS-ENN
committed
use-ecb-mode-csharp
1 parent 619fd4b commit 033bad0

File tree

4 files changed

+631
-0
lines changed

4 files changed

+631
-0
lines changed

‎rules/csharp/security/use-ecb-mode-csharp.yml

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
id: use-ecb-mode-csharp
2+
language: csharp
3+
severity: warning
4+
message: >-
5+
"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."
6+
note: >-
7+
[CWE-327] Use of a Broken or Risky Cryptographic Algorithm
8+
[REFERENCES]
9+
- https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0
10+
- https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0
11+
- https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0
12+
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes
13+
14+
ast-grep-essentials: true
15+
16+
utils:
17+
use_of_instance:
18+
any:
19+
- matches: declaration_of_instance
20+
- has:
21+
matches: declaration_of_instance
22+
declaration_of_instance:
23+
any:
24+
- kind: local_declaration_statement
25+
- kind: field_declaration
26+
has:
27+
nthChild: 1
28+
kind: variable_declaration
29+
all:
30+
- has:
31+
nthChild: 1
32+
kind: identifier
33+
field: type
34+
regex: ^(SymmetricAlgorithm|Aes|Rijndael|DES|TripleDES|RC2)$
35+
- has:
36+
nthChild: 2
37+
kind: variable_declarator
38+
has:
39+
nthChild: 1
40+
kind: identifier
41+
field: name
42+
pattern: $INST
43+
44+
rule:
45+
any:
46+
- all:
47+
- any:
48+
- kind: invocation_expression
49+
all:
50+
- has:
51+
nthChild: 1
52+
kind: member_access_expression
53+
all:
54+
- has:
55+
nthChild: 1
56+
kind: identifier
57+
field: expression
58+
pattern: $INST
59+
- has:
60+
nthChild: 2
61+
kind: identifier
62+
field: name
63+
regex: ^(DecryptEcb|EncryptEcb)$
64+
- has:
65+
nthChild: 2
66+
kind: argument_list
67+
- kind: expression_statement
68+
has:
69+
kind: assignment_expression
70+
nthChild: 1
71+
all:
72+
- has:
73+
nthChild: 1
74+
kind: member_access_expression
75+
all:
76+
- has:
77+
nthChild: 1
78+
kind: identifier
79+
field: expression
80+
pattern: $INST
81+
- has:
82+
nthChild: 2
83+
kind: identifier
84+
field: name
85+
regex: ^(Mode)$
86+
87+
- has:
88+
nthChild: 2
89+
kind: member_access_expression
90+
all:
91+
- has:
92+
nthChild: 1
93+
kind: identifier
94+
field: expression
95+
regex: ^(CipherMode)$
96+
- has:
97+
nthChild: 2
98+
kind: identifier
99+
field: name
100+
regex: ^(ECB)$
101+
any:
102+
- inside:
103+
stopBy: end
104+
follows:
105+
stopBy: end
106+
matches: use_of_instance
107+
- follows:
108+
stopBy: end
109+
matches: use_of_instance
110+
- inside:
111+
stopBy: end
112+
kind: block
113+
follows:
114+
kind: parameter_list
115+
has:
116+
kind: parameter
117+
all:
118+
- has:
119+
nthChild: 1
120+
kind: identifier
121+
field: type
122+
regex: ^(SymmetricAlgorithm|Aes|Rijndael|DES|TripleDES|RC2)$
123+
- has:
124+
nthChild: 2
125+
kind: identifier
126+
field: name
127+
pattern: $INST
128+
- all:
129+
- any:
130+
- kind: invocation_expression
131+
all:
132+
- has:
133+
nthChild: 1
134+
kind: member_access_expression
135+
all:
136+
- has:
137+
nthChild: 1
138+
kind: identifier
139+
field: expression
140+
regex: ^(SymmetricAlgorithm|Aes|Rijndael|DES|TripleDES|RC2)$
141+
- has:
142+
nthChild: 2
143+
kind: identifier
144+
field: name
145+
regex: ^(DecryptEcb|EncryptEcb)$
146+
- has:
147+
nthChild: 2
148+
kind: argument_list
149+
- kind: expression_statement
150+
has:
151+
kind: assignment_expression
152+
nthChild: 1
153+
all:
154+
- has:
155+
nthChild: 1
156+
kind: member_access_expression
157+
all:
158+
- has:
159+
nthChild: 1
160+
kind: identifier
161+
field: expression
162+
regex: ^(SymmetricAlgorithm|Aes|Rijndael|DES|TripleDES|RC2)$
163+
- has:
164+
nthChild: 2
165+
kind: identifier
166+
field: name
167+
regex: ^(Mode)$
168+
169+
- has:
170+
nthChild: 2
171+
kind: member_access_expression
172+
all:
173+
- has:
174+
nthChild: 1
175+
kind: identifier
176+
field: expression
177+
regex: ^(CipherMode)$
178+
- has:
179+
nthChild: 2
180+
kind: identifier
181+
field: name
182+
regex: ^(ECB)$

0 commit comments

Comments
 (0)