Add Security Rules for Weak Cryptographic Practices in Java and Go #116
Conversation
|
Sakshis seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
WalkthroughThis pull request introduces three new security rules for Java applications focusing on cryptographic vulnerabilities. The rules detect the use of insecure cryptographic algorithms (RC2 and RC4) and weak RSA key sizes. Each rule is accompanied by corresponding test configurations and snapshot files to validate the detection mechanism. The changes aim to enhance security checks by flagging potentially vulnerable cryptographic implementations and providing guidance for using more secure alternatives. Changes
Sequence DiagramsequenceDiagram
participant Code
participant SecurityRule
participant CryptoAnalyzer
Code->>SecurityRule: Invoke cryptographic method
SecurityRule->>CryptoAnalyzer: Analyze algorithm/key size
CryptoAnalyzer-->>SecurityRule: Detect vulnerability
SecurityRule-->>Code: Warn about insecure implementation
Possibly related PRs
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
coderabbitai
bot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 11
🧹 Nitpick comments (6)
tests/java/use-of-rc4-java-test.yml (1)
3-4: Consider adding IV initialization test case for AES/CBC.While AES/CBC/PKCS7PADDING is a secure choice, it requires proper IV (Initialization Vector) handling. Consider adding a test case that demonstrates proper IV initialization to provide a complete example of secure usage.
valid: - | Cipher.getInstance("AES/CBC/PKCS7PADDING"); + - | + SecureRandom random = new SecureRandom(); + byte[] iv = new byte[16]; + random.nextBytes(iv); + IvParameterSpec ivSpec = new IvParameterSpec(iv); + Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7PADDING"); + cipher.init(Cipher.ENCRYPT_MODE, key, ivSpec);rules/java/security/use-of-rc4-java.yml (1)
4-9: Enhance security guidance in the message.The message provides good information but could be enhanced with more specific guidance:
message: >- 'Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a - strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See + strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING") with a + secure random IV. Key size should be at least 256 bits. See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.'tests/java/use-of-rc2-java-test.yml (1)
1-39: Consider adding more test scenariosWhile the current test cases cover basic RC2 usage patterns, consider adding tests for:
- RC2 with different modes (ECB, CBC, etc.)
- RC2 with different key sizes
- RC2 usage through reflection
- RC2 string concatenation cases
Would you like me to provide examples for these additional test cases?
tests/__snapshots__/use-of-rc2-java-snapshot.yml (1)
1-70: Consider adding negative test casesThe snapshot tests only verify positive matches. Consider adding negative test cases to ensure the rule doesn't produce false positives, such as:
- Similar algorithm names (e.g., "RC2Padding")
- Comments containing "RC2"
- String variables containing "RC2" but used for other purposes
Would you like me to provide examples for these negative test cases?
rules/java/security/use-of-weak-rsa-key-go.yml (1)
4-5: Enhance the warning message with specific requirementsThe current message could be more informative. Consider expanding it to include:
- The minimum required key size (2048 bits)
- The reason for this requirement
- The impact of using weaker keys
- RSA keys should be at least 2048 bits. + RSA keys should be at least 2048 bits for adequate security. Keys smaller than 2048 bits are considered cryptographically weak and may be vulnerable to factoring attacks.tests/java/use-of-weak-rsa-key-go-test.yml (1)
1-13: Add more test cases for comprehensive coverageWhile the current test cases cover basic scenarios, consider adding these additional cases for better coverage:
valid: - | rsa.GenerateKey(rand.Reader, 2048) + - | + rsa.GenerateKey(rand.Reader, 4096) invalid: - | pvk, err := rsa.GenerateKey(rand.Reader, 1025) - | pvk, err := rsa.GenerateKey(rand.Reader, -1929) - | pvk, err := rsa.GenerateKey(rand.Reader, 102.5) - | pvk, err := rsa.GenerateKey(rand.Reader, 192) + - | + pvk, err := rsa.GenerateKey(rand.Reader, 2047) + - | + pvk, err := rsa.GenerateKey(rand.Reader, 0)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
rules/java/security/use-of-rc2-java.yml(1 hunks)rules/java/security/use-of-rc4-java.yml(1 hunks)rules/java/security/use-of-weak-rsa-key-go.yml(1 hunks)tests/__snapshots__/use-of-rc2-java-snapshot.yml(1 hunks)tests/__snapshots__/use-of-rc4-java-snapshot.yml(1 hunks)tests/__snapshots__/use-of-weak-rsa-key-go-snapshot.yml(1 hunks)tests/java/use-of-rc2-java-test.yml(1 hunks)tests/java/use-of-rc4-java-test.yml(1 hunks)tests/java/use-of-weak-rsa-key-go-test.yml(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- tests/snapshots/use-of-rc4-java-snapshot.yml
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
tests/java/use-of-weak-rsa-key-java-test.yml (1)
6-15: Consider adding more edge cases for comprehensive testing.While the current invalid cases cover important scenarios (weak key size, negative value, decimal value), consider adding these additional test cases:
- Key size of 0
- Very large key sizes (e.g., Integer.MAX_VALUE)
- Common weak sizes (e.g., 1024 bits)
rules/java/security/use-of-weak-rsa-key-java.yml (1)
44-46: Fix indentation and trailing spaces.The YAML indentation is incorrect and there are trailing spaces.
Apply this diff to fix the formatting:
-constraints: - AST: - regex: '^(-?(0|[1-9][0-9]?|[1-9][0-9]{2}|1[0-9]{3}|20[0-3][0-9]|204[0-7])(\.[0-9]+)?|0|-[1-9][0-9]*|-[1-9][0-9]{2,}|-1[0-9]{3}|-20[0-3][0-9]|-204[0-7])$' +constraints: + AST: + regex: '^(-?(0|[1-9][0-9]?|[1-9][0-9]{2}|1[0-9]{3}|20[0-3][0-9]|204[0-7])(\.[0-9]+)?|0|-[1-9][0-9]*|-[1-9][0-9]{2,}|-1[0-9]{3}|-20[0-3][0-9]|-204[0-7])$'🧰 Tools
🪛 yamllint (1.35.1)
[error] 44-44: trailing spaces
(trailing-spaces)
[warning] 45-45: wrong indentation: expected 2 but found 6
(indentation)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
rules/java/security/use-of-weak-rsa-key-java.yml(1 hunks)tests/__snapshots__/use-of-weak-rsa-key-java-snapshot.yml(1 hunks)tests/java/use-of-weak-rsa-key-java-test.yml(1 hunks)
🧰 Additional context used
🪛 yamllint (1.35.1)
rules/java/security/use-of-weak-rsa-key-java.yml
[error] 15-15: trailing spaces
(trailing-spaces)
[error] 44-44: trailing spaces
(trailing-spaces)
[warning] 45-45: wrong indentation: expected 2 but found 6
(indentation)
🔇 Additional comments (3)
tests/java/use-of-weak-rsa-key-java-test.yml (1)
2-5: LGTM! Valid test case correctly demonstrates secure key size.
The test case properly validates the use of 2048-bit RSA keys, which aligns with NIST recommendations for secure cryptographic practices.
rules/java/security/use-of-weak-rsa-key-java.yml (1)
1-7: LGTM! Well-documented security rule with proper references.
The rule is well-defined with:
- Appropriate severity level
- Clear message explaining the requirement
- Proper reference to CWE-326
tests/__snapshots__/use-of-weak-rsa-key-java-snapshot.yml (1)
1-98: LGTM! Snapshots properly capture test scenarios.
The snapshots:
- Accurately capture all test cases
- Include proper source mapping
- Have detailed labels for key components
| rule: | ||
| kind: expression_statement | ||
| matches: WeakRSA | ||
| constraints: | ||
| AST: | ||
| regex: '^(-?(0|[1-9][0-9]?|[1-9][0-9]{2}|1[0-9]{3}|20[0-3][0-9]|204[0-7])(\.[0-9]+)?|0|-[1-9][0-9]*|-[1-9][0-9]{2,}|-1[0-9]{3}|-20[0-3][0-9]|-204[0-7])$' |
There was a problem hiding this comment.
💡 Codebase verification
The regex pattern for RSA key size validation is incorrect and potentially dangerous
The test results reveal critical issues with the regex pattern:
- It incorrectly accepts weak key sizes (512, 1024) that should be rejected
- It incorrectly rejects secure key sizes (2048, 4096) that should be accepted
- It dangerously accepts invalid values like negative numbers (-512), decimals (51.2), and zero (0)
For RSA keys, the pattern should:
- Reject sizes below 2048 bits (current security standard)
- Accept sizes 2048 bits and above
- Only allow positive integers
🔗 Analysis chain
Verify the regex pattern coverage.
The regex pattern for key size validation is complex. Let's verify its coverage:
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Test regex pattern against various key sizes
echo "Testing key sizes against the regex pattern..."
test_sizes=(
"2048" # Valid
"512" # Invalid - too small
"-512" # Invalid - negative
"51.2" # Invalid - decimal
"0" # Invalid - zero
"4096" # Valid
"1024" # Invalid - too small
)
for size in "${test_sizes[@]}"; do
if echo "$size" | grep -P '^(-?(0|[1-9][0-9]?|[1-9][0-9]{2}|1[0-9]{3}|20[0-3][0-9]|204[0-7])(\.[0-9]+)?|0|-[1-9][0-9]*|-[1-9][0-9]{2,}|-1[0-9]{3}|-20[0-3][0-9]|-204[0-7])$' > /dev/null; then
echo "✓ $size matches the pattern"
else
echo "✗ $size does not match the pattern"
fi
done
Length of output: 2033
🧰 Tools
🪛 yamllint (1.35.1)
[error] 44-44: trailing spaces
(trailing-spaces)
[warning] 45-45: wrong indentation: expected 2 but found 6
(indentation)
Summary by CodeRabbit
New Features
Bug Fixes
Tests