Skip to content

Commit 3592c52

Browse files
ESS-ENNESS-ENN
authored
Rules - One go and one java rule - 11Oct2024 (#18)
* blowfish-insufficient-key-size-java * tls-with-insecure-cipher-go
1 parent f43b4ed commit 3592c52

6 files changed

+240
-0
lines changed

‎rules/go/security/tls-with-insecure-cipher-go.yml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
id: tls-with-insecure-cipher-go
2+
language: go
3+
severity: warning
4+
message: >-
5+
Detected an insecure CipherSuite via the 'tls' module. This suite is
6+
considered weak. Use the function 'tls.CipherSuites()' to get a list of
7+
good cipher suites. See
8+
https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what
9+
other cipher suites to use.
10+
note: >-
11+
[CWE-327]: Use of a Broken or Risky Cryptographic Algorithm
12+
[OWASP A03:2017]: Sensitive Data Exposure
13+
[OWASP A02:2021]: Cryptographic Failures
14+
[REFERENCES]
15+
https://owasp.org/Top10/A02_2021-Cryptographic_Failures
16+
utils:
17+
match_tls_ciphersuite:
18+
kind: literal_element
19+
has:
20+
stopBy: end
21+
kind: composite_literal
22+
all:
23+
- has:
24+
stopBy: end
25+
kind: qualified_type
26+
regex: ^(tls.CipherSuite)
27+
- has:
28+
stopBy: end
29+
kind: literal_value
30+
has:
31+
stopBy: end
32+
kind: literal_element
33+
pattern: $R
34+
regex: TLS_RSA_WITH_RC4_128_SHA|TLS_RSA_WITH_3DES_EDE_CBC_SHA|TLS_RSA_WITH_AES_128_CBC_SHA256|TLS_ECDHE_ECDSA_WITH_RC4_128_SHA|TLS_ECDHE_RSA_WITH_RC4_128_SHA|TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
35+
method_tls_config:
36+
kind: composite_literal
37+
all:
38+
- has:
39+
kind: qualified_type
40+
regex: ^(tls.Config)
41+
- has:
42+
stopBy: end
43+
kind: literal_value
44+
has:
45+
stopBy: end
46+
kind: literal_element
47+
pattern: $F
48+
regex: tls.TLS_RSA_WITH_RC4_128_SHA|tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA|tls.TLS_RSA_WITH_AES_128_CBC_SHA256|tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA|tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA|tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA|tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256|tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
49+
50+
rule:
51+
any:
52+
- matches: match_tls_ciphersuite
53+
- matches: method_tls_config

‎rules/java/security/blowfish-insufficient-key-size-java.yml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
id: blowfish-insufficient-key-size-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
Using less than 128 bits for Blowfish is considered insecure. Use 128
6+
bits or more, or switch to use AES instead.
7+
note: >-
8+
[CWE-326] Inadequate Encryption Strength.
9+
[REFERENCES]
10+
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
11+
utils:
12+
MATCH_PATTERN_KEYGENERATOR:
13+
kind: expression_statement
14+
all:
15+
- has:
16+
stopBy: end
17+
kind: method_invocation
18+
all:
19+
- has:
20+
stopBy: end
21+
kind: identifier
22+
- has:
23+
stopBy: neighbor
24+
kind: identifier
25+
regex: '\binit\b'
26+
- has:
27+
stopBy: end
28+
kind: argument_list
29+
has:
30+
stopBy: end
31+
kind: decimal_integer_literal
32+
pattern: $R
33+
- follows:
34+
stopBy: end
35+
kind: local_variable_declaration
36+
has:
37+
stopBy: end
38+
kind: method_invocation
39+
all:
40+
- has:
41+
stopBy: neighbor
42+
kind: identifier
43+
regex: '\bKeyGenerator\b'
44+
- has:
45+
stopBy: neighbor
46+
kind: identifier
47+
regex: '\bgetInstance\b'
48+
- has:
49+
stopBy: neighbor
50+
kind: argument_list
51+
has:
52+
stopBy: neighbor
53+
kind: string_literal
54+
regex: '\bBlowfish\b'
55+
56+
rule:
57+
kind: expression_statement
58+
matches: MATCH_PATTERN_KEYGENERATOR
59+
60+
constraints:
61+
R:
62+
regex: ^(?:[1-9]?[0-9]|1[01][0-9]|127)$

‎tests/__snapshots__/blowfish-insufficient-key-size-java-snapshot.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
id: blowfish-insufficient-key-size-java
2+
snapshots:
3+
? |
4+
public void unsafeKeySize() {
5+
KeyGenerator keyGen = KeyGenerator.getInstance("Blowfish");
6+
keyGen.init(64);
7+
}
8+
: labels:
9+
- source: keyGen.init(64);
10+
style: primary
11+
start: 96
12+
end: 112
13+
- source: keyGen
14+
style: secondary
15+
start: 96
16+
end: 102
17+
- source: init
18+
style: secondary
19+
start: 103
20+
end: 107
21+
- source: '64'
22+
style: secondary
23+
start: 108
24+
end: 110
25+
- source: (64)
26+
style: secondary
27+
start: 107
28+
end: 111
29+
- source: keyGen.init(64)
30+
style: secondary
31+
start: 96
32+
end: 111
33+
- source: KeyGenerator
34+
style: secondary
35+
start: 55
36+
end: 67
37+
- source: getInstance
38+
style: secondary
39+
start: 68
40+
end: 79
41+
- source: '"Blowfish"'
42+
style: secondary
43+
start: 80
44+
end: 90
45+
- source: ("Blowfish")
46+
style: secondary
47+
start: 79
48+
end: 91
49+
- source: KeyGenerator.getInstance("Blowfish")
50+
style: secondary
51+
start: 55
52+
end: 91
53+
- source: KeyGenerator keyGen = KeyGenerator.getInstance("Blowfish");
54+
style: secondary
55+
start: 33
56+
end: 92

‎tests/__snapshots__/tls-with-insecure-cipher-go-snapshot.yml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
id: tls-with-insecure-cipher-go
2+
snapshots:
3+
? |
4+
tr := &http.Transport{
5+
TLSClientConfig: &tls.Config{CipherSuites: []uint16{
6+
tls.TLS_RSA_WITH_RC4_128_SHA,
7+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
8+
}},
9+
}
10+
: labels:
11+
- source: |-
12+
tls.Config{CipherSuites: []uint16{
13+
tls.TLS_RSA_WITH_RC4_128_SHA,
14+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
15+
}}
16+
style: primary
17+
start: 41
18+
end: 151
19+
- source: tls.Config
20+
style: secondary
21+
start: 41
22+
end: 51
23+
- source: |-
24+
[]uint16{
25+
tls.TLS_RSA_WITH_RC4_128_SHA,
26+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
27+
}
28+
style: secondary
29+
start: 66
30+
end: 150
31+
- source: |-
32+
{CipherSuites: []uint16{
33+
tls.TLS_RSA_WITH_RC4_128_SHA,
34+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
35+
}}
36+
style: secondary
37+
start: 51
38+
end: 151

‎tests/go/tls-with-insecure-cipher-go-test.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: tls-with-insecure-cipher-go
2+
valid:
3+
- |
4+
tr := &http.Transport{
5+
TLSClientConfig: &tls.Config{CipherSuites: []uint16{
6+
tls.TLS_AES_128_GCM_SHA256,
7+
tls.TLS_AES_256_GCM_SHA384,
8+
}},
9+
}
10+
11+
invalid:
12+
- |
13+
tr := &http.Transport{
14+
TLSClientConfig: &tls.Config{CipherSuites: []uint16{
15+
tls.TLS_RSA_WITH_RC4_128_SHA,
16+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
17+
}},
18+
}

‎tests/java/blowfish-insufficient-key-size-java-test.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: blowfish-insufficient-key-size-java
2+
valid:
3+
- |
4+
public void safeKeySize() {
5+
KeyGenerator keyGen = KeyGenerator.getInstance("Blowfish");
6+
keyGen.init(128);
7+
}
8+
invalid:
9+
- |
10+
public void unsafeKeySize() {
11+
KeyGenerator keyGen = KeyGenerator.getInstance("Blowfish");
12+
keyGen.init(64);
13+
}

0 commit comments

Comments
 (0)