Skip to content

Commit 2edc9af

Browse files
jbjjbj
authored
Merge pull request #18848 from jbj/StaticInitializationVector-postprocess
Java: StaticInitializationVector with postprocess
2 parents f406914 + 11a0a9f commit 2edc9af

5 files changed

+80
-31
lines changed

‎java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.expected

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#select
2+
| StaticInitializationVector.java:19:51:19:56 | ivSpec | StaticInitializationVector.java:13:21:13:81 | new byte[] : byte[] | StaticInitializationVector.java:19:51:19:56 | ivSpec | A $@ should not be used for encryption. | StaticInitializationVector.java:13:21:13:81 | new byte[] | static initialization vector |
3+
| StaticInitializationVector.java:32:51:32:56 | ivSpec | StaticInitializationVector.java:26:21:26:32 | new byte[] : byte[] | StaticInitializationVector.java:32:51:32:56 | ivSpec | A $@ should not be used for encryption. | StaticInitializationVector.java:26:21:26:32 | new byte[] | static initialization vector |
4+
| StaticInitializationVector.java:48:51:48:56 | ivSpec | StaticInitializationVector.java:39:21:39:32 | new byte[] : byte[] | StaticInitializationVector.java:48:51:48:56 | ivSpec | A $@ should not be used for encryption. | StaticInitializationVector.java:39:21:39:32 | new byte[] | static initialization vector |
5+
| StaticInitializationVector.java:64:51:64:56 | ivSpec | StaticInitializationVector.java:55:30:58:9 | new byte[][] : byte[][] | StaticInitializationVector.java:64:51:64:56 | ivSpec | A $@ should not be used for encryption. | StaticInitializationVector.java:55:30:58:9 | new byte[][] | static initialization vector |
6+
| StaticInitializationVector.java:80:51:80:56 | ivSpec | StaticInitializationVector.java:71:30:74:9 | new byte[][] : byte[][] | StaticInitializationVector.java:80:51:80:56 | ivSpec | A $@ should not be used for encryption. | StaticInitializationVector.java:71:30:74:9 | new byte[][] | static initialization vector |
7+
| StaticInitializationVector.java:96:51:96:56 | ivSpec | StaticInitializationVector.java:88:13:88:23 | new byte[] : byte[] | StaticInitializationVector.java:96:51:96:56 | ivSpec | A $@ should not be used for encryption. | StaticInitializationVector.java:88:13:88:23 | new byte[] | static initialization vector |
8+
| StaticInitializationVector.java:96:51:96:56 | ivSpec | StaticInitializationVector.java:89:13:89:24 | new byte[] : byte[] | StaticInitializationVector.java:96:51:96:56 | ivSpec | A $@ should not be used for encryption. | StaticInitializationVector.java:89:13:89:24 | new byte[] | static initialization vector |
9+
edges
10+
| StaticInitializationVector.java:13:21:13:81 | new byte[] : byte[] | StaticInitializationVector.java:15:61:15:62 | iv : byte[] | provenance | |
11+
| StaticInitializationVector.java:15:35:15:63 | new GCMParameterSpec(...) : GCMParameterSpec | StaticInitializationVector.java:19:51:19:56 | ivSpec | provenance | Sink:MaD:1 |
12+
| StaticInitializationVector.java:15:61:15:62 | iv : byte[] | StaticInitializationVector.java:15:35:15:63 | new GCMParameterSpec(...) : GCMParameterSpec | provenance | MaD:2 |
13+
| StaticInitializationVector.java:26:21:26:32 | new byte[] : byte[] | StaticInitializationVector.java:28:61:28:62 | iv : byte[] | provenance | |
14+
| StaticInitializationVector.java:28:35:28:63 | new GCMParameterSpec(...) : GCMParameterSpec | StaticInitializationVector.java:32:51:32:56 | ivSpec | provenance | Sink:MaD:1 |
15+
| StaticInitializationVector.java:28:61:28:62 | iv : byte[] | StaticInitializationVector.java:28:35:28:63 | new GCMParameterSpec(...) : GCMParameterSpec | provenance | MaD:2 |
16+
| StaticInitializationVector.java:39:21:39:32 | new byte[] : byte[] | StaticInitializationVector.java:44:54:44:55 | iv : byte[] | provenance | |
17+
| StaticInitializationVector.java:44:34:44:56 | new IvParameterSpec(...) : IvParameterSpec | StaticInitializationVector.java:48:51:48:56 | ivSpec | provenance | Sink:MaD:1 |
18+
| StaticInitializationVector.java:44:54:44:55 | iv : byte[] | StaticInitializationVector.java:44:34:44:56 | new IvParameterSpec(...) : IvParameterSpec | provenance | MaD:3 |
19+
| StaticInitializationVector.java:55:30:58:9 | new byte[][] : byte[][] | StaticInitializationVector.java:60:61:60:72 | ...[...] : byte[] | provenance | |
20+
| StaticInitializationVector.java:60:35:60:73 | new GCMParameterSpec(...) : GCMParameterSpec | StaticInitializationVector.java:64:51:64:56 | ivSpec | provenance | Sink:MaD:1 |
21+
| StaticInitializationVector.java:60:61:60:72 | ...[...] : byte[] | StaticInitializationVector.java:60:35:60:73 | new GCMParameterSpec(...) : GCMParameterSpec | provenance | MaD:2 |
22+
| StaticInitializationVector.java:71:30:74:9 | new byte[][] : byte[][] | StaticInitializationVector.java:76:61:76:72 | ...[...] : byte[] | provenance | |
23+
| StaticInitializationVector.java:76:35:76:73 | new GCMParameterSpec(...) : GCMParameterSpec | StaticInitializationVector.java:80:51:80:56 | ivSpec | provenance | Sink:MaD:1 |
24+
| StaticInitializationVector.java:76:61:76:72 | ...[...] : byte[] | StaticInitializationVector.java:76:35:76:73 | new GCMParameterSpec(...) : GCMParameterSpec | provenance | MaD:2 |
25+
| StaticInitializationVector.java:87:24:90:9 | {...} : byte[][] [[]] : byte[] | StaticInitializationVector.java:92:61:92:63 | ivs : byte[][] [[]] : byte[] | provenance | |
26+
| StaticInitializationVector.java:88:13:88:23 | new byte[] : byte[] | StaticInitializationVector.java:87:24:90:9 | {...} : byte[][] [[]] : byte[] | provenance | |
27+
| StaticInitializationVector.java:89:13:89:24 | new byte[] : byte[] | StaticInitializationVector.java:87:24:90:9 | {...} : byte[][] [[]] : byte[] | provenance | |
28+
| StaticInitializationVector.java:92:35:92:67 | new GCMParameterSpec(...) : GCMParameterSpec | StaticInitializationVector.java:96:51:96:56 | ivSpec | provenance | Sink:MaD:1 |
29+
| StaticInitializationVector.java:92:61:92:63 | ivs : byte[][] [[]] : byte[] | StaticInitializationVector.java:92:61:92:66 | ...[...] : byte[] | provenance | |
30+
| StaticInitializationVector.java:92:61:92:66 | ...[...] : byte[] | StaticInitializationVector.java:92:35:92:67 | new GCMParameterSpec(...) : GCMParameterSpec | provenance | MaD:2 |
31+
models
32+
| 1 | Sink: javax.crypto; Cipher; true; init; (int,Key,AlgorithmParameterSpec); ; Argument[2]; encryption-iv; manual |
33+
| 2 | Summary: javax.crypto.spec; GCMParameterSpec; true; GCMParameterSpec; ; ; Argument[1]; Argument[this]; taint; manual |
34+
| 3 | Summary: javax.crypto.spec; IvParameterSpec; true; IvParameterSpec; ; ; Argument[0]; Argument[this]; taint; manual |
35+
nodes
36+
| StaticInitializationVector.java:13:21:13:81 | new byte[] : byte[] | semmle.label | new byte[] : byte[] |
37+
| StaticInitializationVector.java:15:35:15:63 | new GCMParameterSpec(...) : GCMParameterSpec | semmle.label | new GCMParameterSpec(...) : GCMParameterSpec |
38+
| StaticInitializationVector.java:15:61:15:62 | iv : byte[] | semmle.label | iv : byte[] |
39+
| StaticInitializationVector.java:19:51:19:56 | ivSpec | semmle.label | ivSpec |
40+
| StaticInitializationVector.java:26:21:26:32 | new byte[] : byte[] | semmle.label | new byte[] : byte[] |
41+
| StaticInitializationVector.java:28:35:28:63 | new GCMParameterSpec(...) : GCMParameterSpec | semmle.label | new GCMParameterSpec(...) : GCMParameterSpec |
42+
| StaticInitializationVector.java:28:61:28:62 | iv : byte[] | semmle.label | iv : byte[] |
43+
| StaticInitializationVector.java:32:51:32:56 | ivSpec | semmle.label | ivSpec |
44+
| StaticInitializationVector.java:39:21:39:32 | new byte[] : byte[] | semmle.label | new byte[] : byte[] |
45+
| StaticInitializationVector.java:44:34:44:56 | new IvParameterSpec(...) : IvParameterSpec | semmle.label | new IvParameterSpec(...) : IvParameterSpec |
46+
| StaticInitializationVector.java:44:54:44:55 | iv : byte[] | semmle.label | iv : byte[] |
47+
| StaticInitializationVector.java:48:51:48:56 | ivSpec | semmle.label | ivSpec |
48+
| StaticInitializationVector.java:55:30:58:9 | new byte[][] : byte[][] | semmle.label | new byte[][] : byte[][] |
49+
| StaticInitializationVector.java:60:35:60:73 | new GCMParameterSpec(...) : GCMParameterSpec | semmle.label | new GCMParameterSpec(...) : GCMParameterSpec |
50+
| StaticInitializationVector.java:60:61:60:72 | ...[...] : byte[] | semmle.label | ...[...] : byte[] |
51+
| StaticInitializationVector.java:64:51:64:56 | ivSpec | semmle.label | ivSpec |
52+
| StaticInitializationVector.java:71:30:74:9 | new byte[][] : byte[][] | semmle.label | new byte[][] : byte[][] |
53+
| StaticInitializationVector.java:76:35:76:73 | new GCMParameterSpec(...) : GCMParameterSpec | semmle.label | new GCMParameterSpec(...) : GCMParameterSpec |
54+
| StaticInitializationVector.java:76:61:76:72 | ...[...] : byte[] | semmle.label | ...[...] : byte[] |
55+
| StaticInitializationVector.java:80:51:80:56 | ivSpec | semmle.label | ivSpec |
56+
| StaticInitializationVector.java:87:24:90:9 | {...} : byte[][] [[]] : byte[] | semmle.label | {...} : byte[][] [[]] : byte[] |
57+
| StaticInitializationVector.java:88:13:88:23 | new byte[] : byte[] | semmle.label | new byte[] : byte[] |
58+
| StaticInitializationVector.java:89:13:89:24 | new byte[] : byte[] | semmle.label | new byte[] : byte[] |
59+
| StaticInitializationVector.java:92:35:92:67 | new GCMParameterSpec(...) : GCMParameterSpec | semmle.label | new GCMParameterSpec(...) : GCMParameterSpec |
60+
| StaticInitializationVector.java:92:61:92:63 | ivs : byte[][] [[]] : byte[] | semmle.label | ivs : byte[][] [[]] : byte[] |
61+
| StaticInitializationVector.java:92:61:92:66 | ...[...] : byte[] | semmle.label | ...[...] : byte[] |
62+
| StaticInitializationVector.java:96:51:96:56 | ivSpec | semmle.label | ivSpec |
63+
subpaths

‎java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.java

+13-13
Original file line numberDiff line numberDiff line change
@@ -10,33 +10,33 @@ public class StaticInitializationVector {
1010

1111
// BAD: AES-GCM with static IV from a byte array
1212
public byte[] encryptWithStaticIvByteArrayWithInitializer(byte[] key, byte[] plaintext) throws Exception {
13-
byte[] iv = new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 };
13+
byte[] iv = new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }; // $Source
1414

1515
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
1616
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
1717

1818
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
19-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $staticInitializationVector
19+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert
2020
cipher.update(plaintext);
2121
return cipher.doFinal();
2222
}
2323

2424
// BAD: AES-GCM with static IV from zero-initialized byte array
2525
public byte[] encryptWithZeroStaticIvByteArray(byte[] key, byte[] plaintext) throws Exception {
26-
byte[] iv = new byte[16];
26+
byte[] iv = new byte[16]; // $Source
2727

2828
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
2929
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
3030

3131
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
32-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $staticInitializationVector
32+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert
3333
cipher.update(plaintext);
3434
return cipher.doFinal();
3535
}
3636

3737
// BAD: AES-CBC with static IV from zero-initialized byte array
3838
public byte[] encryptWithStaticIvByteArray(byte[] key, byte[] plaintext) throws Exception {
39-
byte[] iv = new byte[16];
39+
byte[] iv = new byte[16]; // $Source
4040
for (byte i = 0; i < iv.length; i++) {
4141
iv[i] = 1;
4242
}
@@ -45,7 +45,7 @@ public byte[] encryptWithStaticIvByteArray(byte[] key, byte[] plaintext) throws
4545
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
4646

4747
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
48-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $staticInitializationVector
48+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert
4949
cipher.update(plaintext);
5050
return cipher.doFinal();
5151
}
@@ -55,13 +55,13 @@ public byte[] encryptWithOneOfStaticIvs01(byte[] key, byte[] plaintext) throws E
5555
byte[][] staticIvs = new byte[][] {
5656
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 },
5757
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 }
58-
};
58+
}; // $Source
5959

6060
GCMParameterSpec ivSpec = new GCMParameterSpec(128, staticIvs[1]);
6161
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
6262

6363
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
64-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $staticInitializationVector
64+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert
6565
cipher.update(plaintext);
6666
return cipher.doFinal();
6767
}
@@ -71,29 +71,29 @@ public byte[] encryptWithOneOfStaticIvs02(byte[] key, byte[] plaintext) throws E
7171
byte[][] staticIvs = new byte[][] {
7272
new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 },
7373
new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 }
74-
};
74+
}; // $Source
7575

7676
GCMParameterSpec ivSpec = new GCMParameterSpec(128, staticIvs[1]);
7777
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
7878

7979
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
80-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $staticInitializationVector
80+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert
8181
cipher.update(plaintext);
8282
return cipher.doFinal();
8383
}
8484

8585
// BAD: AES-GCM with static IV from a multidimensional byte array
8686
public byte[] encryptWithOneOfStaticZeroIvs(byte[] key, byte[] plaintext) throws Exception {
8787
byte[][] ivs = new byte[][] {
88-
new byte[8],
89-
new byte[16]
88+
new byte[8], // $Source
89+
new byte[16] // $Source
9090
};
9191

9292
GCMParameterSpec ivSpec = new GCMParameterSpec(128, ivs[1]);
9393
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
9494

9595
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
96-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $staticInitializationVector
96+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert
9797
cipher.update(plaintext);
9898
return cipher.doFinal();
9999
}

‎java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.qlref

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
query: Security/CWE/CWE-1204/StaticInitializationVector.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎java/ql/test/query-tests/security/CWE-1204/StaticInitializationVectorTest.expected

Whitespace-only changes.

‎java/ql/test/query-tests/security/CWE-1204/StaticInitializationVectorTest.ql

-18
This file was deleted.

0 commit comments

Comments
 (0)