Skip to content

Commit dd0ee0e

Browse files
n1ckl0sk0rtgen1ckl0sk0rtge
authored
add gcm mode as part of detection for gcm parameter spec, make all iValue objects also iActionvalues (#235)
Signed-off-by: Nicklas Körtge <nicklas.koertge1@ibm.com>
1 parent 1d383b3 commit dd0ee0e

File tree

5 files changed

+89
-67
lines changed

5 files changed

+89
-67
lines changed

‎engine/src/main/java/com/ibm/engine/model/AbstractValue.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
*/
2020
package com.ibm.engine.model;
2121

22-
public abstract class AbstractValue<T> implements IValue<T> {
22+
public abstract class AbstractValue<T> implements IAction<T> {
2323
public abstract boolean equals(Object other);
2424

2525
public abstract int hashCode();

‎java/src/main/java/com/ibm/plugin/rules/detection/jca/algorithmspec/JcaGCMParameterSpec.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,15 @@
1919
*/
2020
package com.ibm.plugin.rules.detection.jca.algorithmspec;
2121

22+
import com.ibm.engine.model.Mode;
2223
import com.ibm.engine.model.Size;
2324
import com.ibm.engine.model.context.AlgorithmParameterContext;
2425
import com.ibm.engine.model.factory.InitializationVectorSizeFactory;
2526
import com.ibm.engine.model.factory.TagSizeFactory;
2627
import com.ibm.engine.rule.IDetectionRule;
2728
import com.ibm.engine.rule.builder.DetectionRuleBuilder;
2829
import java.util.List;
30+
import java.util.Optional;
2931
import javax.annotation.Nonnull;
3032
import org.sonar.plugins.java.api.tree.Tree;
3133

@@ -36,6 +38,7 @@ public final class JcaGCMParameterSpec {
3638
.createDetectionRule()
3739
.forObjectTypes("javax.crypto.spec.GCMParameterSpec")
3840
.forConstructor()
41+
.shouldBeDetectedAs(tree -> Optional.of(new Mode<>("GCM", tree)))
3942
.withMethodParameter("int")
4043
.shouldBeDetectedAs(new TagSizeFactory<>(Size.UnitType.BIT))
4144
.withMethodParameter("byte[]")
@@ -49,6 +52,7 @@ public final class JcaGCMParameterSpec {
4952
.createDetectionRule()
5053
.forObjectTypes("javax.crypto.spec.GCMParameterSpec")
5154
.forConstructor()
55+
.shouldBeDetectedAs(tree -> Optional.of(new Mode<>("GCM", tree)))
5256
.withMethodParameter("int")
5357
.shouldBeDetectedAs(new TagSizeFactory<>(Size.UnitType.BIT))
5458
.withMethodParameter("byte[]")

‎java/src/main/java/com/ibm/plugin/translation/translator/contexts/JavaAlgorithmParameterContextTranslator.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,11 @@
2424
import com.ibm.engine.model.InitializationVectorSize;
2525
import com.ibm.engine.model.KeySize;
2626
import com.ibm.engine.model.MacSize;
27+
import com.ibm.engine.model.Mode;
2728
import com.ibm.engine.model.TagSize;
2829
import com.ibm.engine.model.context.IDetectionContext;
2930
import com.ibm.mapper.mapper.jca.JcaAlgorithmMapper;
31+
import com.ibm.mapper.mapper.jca.JcaModeMapper;
3032
import com.ibm.mapper.model.INode;
3133
import com.ibm.mapper.model.InitializationVectorLength;
3234
import com.ibm.mapper.model.KeyLength;
@@ -76,6 +78,9 @@ protected Optional<INode> translateBC(
7678
new InitializationVectorLength(
7779
initializationVectorSize.getValue(), detectionLocation);
7880
return Optional.of(initializationVectorLength);
81+
} else if (value instanceof Mode<Tree> mode) {
82+
final JcaModeMapper modeMapper = new JcaModeMapper();
83+
return modeMapper.parse(mode.asString(), detectionLocation).map(a -> a);
7984
}
8085
return Optional.empty();
8186
}

‎java/src/test/files/rules/detection/jca/algorithmspec/JcaGCMParameterSpecTestFile.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public void test() {
2929
String nonce = "nonce";
3030

3131
GCMParameterSpec gcmSpec = new GCMParameterSpec(128, Base64.getDecoder().decode(nonce));
32-
Cipher cipher = Cipher.getInstance("AES"); // Noncompliant {{(BlockCipher) AES128}}
32+
Cipher cipher = Cipher.getInstance("AES"); // Noncompliant {{(AuthenticatedEncryption) AES128-GCM}}
3333
cipher.init(Cipher.DECRYPT_MODE, secret, gcmSpec);
3434
}
3535
}

‎java/src/test/java/com/ibm/plugin/rules/detection/jca/algorithmspec/JcaGCMParameterSpecTest.java‎

Lines changed: 78 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,15 @@
3333
import com.ibm.engine.model.context.AlgorithmParameterContext;
3434
import com.ibm.engine.model.context.CipherContext;
3535
import com.ibm.engine.model.context.SecretKeyContext;
36+
import com.ibm.mapper.model.AuthenticatedEncryption;
3637
import com.ibm.mapper.model.BlockCipher;
3738
import com.ibm.mapper.model.BlockSize;
3839
import com.ibm.mapper.model.DigestSize;
3940
import com.ibm.mapper.model.INode;
4041
import com.ibm.mapper.model.KeyLength;
4142
import com.ibm.mapper.model.Mac;
4243
import com.ibm.mapper.model.MessageDigest;
44+
import com.ibm.mapper.model.Mode;
4345
import com.ibm.mapper.model.Oid;
4446
import com.ibm.mapper.model.PasswordBasedKeyDerivationFunction;
4547
import com.ibm.mapper.model.PasswordLength;
@@ -290,91 +292,102 @@ public void asserts(
290292
assertThat(value0_1_1.asString()).isEqualTo("AES");
291293

292294
DetectionStore<JavaCheck, Tree, Symbol, JavaFileScannerContext> store_1_2 =
293-
getStoreOfValueType(TagSize.class, store_1.getChildren());
294-
assertThat(store_1_2.getDetectionValues()).hasSize(1);
295+
getStoreOfValueType(com.ibm.engine.model.Mode.class, store_1.getChildren());
296+
assertThat(store_1_2.getDetectionValues()).hasSize(2);
295297
assertThat(store_1_2.getDetectionValueContext())
296298
.isInstanceOf(AlgorithmParameterContext.class);
297299
IValue<Tree> value0_1_2 = store_1_2.getDetectionValues().get(0);
298-
assertThat(value0_1_2).isInstanceOf(TagSize.class);
299-
assertThat(value0_1_2.asString()).isEqualTo("128");
300+
assertThat(value0_1_2).isInstanceOf(com.ibm.engine.model.Mode.class);
301+
assertThat(value0_1_2.asString()).isEqualTo("GCM");
302+
303+
IValue<Tree> value1_1_2 = store_1_2.getDetectionValues().get(1);
304+
assertThat(value1_1_2).isInstanceOf(TagSize.class);
305+
assertThat(value1_1_2.asString()).isEqualTo("128");
300306

301307
/*
302308
* Translation
303309
*/
304310

305311
assertThat(nodes).hasSize(1);
306312

307-
// BlockCipher
308-
INode blockCipherNode1 = nodes.get(0);
309-
assertThat(blockCipherNode1.getKind()).isEqualTo(BlockCipher.class);
310-
assertThat(blockCipherNode1.getChildren()).hasSize(6);
311-
assertThat(blockCipherNode1.asString()).isEqualTo("AES128");
313+
// AuthenticatedEncryption
314+
INode authenticatedEncryptionNode = nodes.get(0);
315+
assertThat(authenticatedEncryptionNode.getKind())
316+
.isEqualTo(AuthenticatedEncryption.class);
317+
assertThat(authenticatedEncryptionNode.getChildren()).hasSize(7);
318+
assertThat(authenticatedEncryptionNode.asString()).isEqualTo("AES128-GCM");
319+
320+
// KeyLength under AuthenticatedEncryption
321+
INode keyLengthNode = authenticatedEncryptionNode.getChildren().get(KeyLength.class);
322+
assertThat(keyLengthNode).isNotNull();
323+
assertThat(keyLengthNode.getChildren()).isEmpty();
324+
assertThat(keyLengthNode.asString()).isEqualTo("128");
312325

313-
// TagLength under BlockCipher
314-
INode tagLengthNode = blockCipherNode1.getChildren().get(TagLength.class);
326+
// TagLength under AuthenticatedEncryption
327+
INode tagLengthNode = authenticatedEncryptionNode.getChildren().get(TagLength.class);
315328
assertThat(tagLengthNode).isNotNull();
316329
assertThat(tagLengthNode.getChildren()).isEmpty();
317330
assertThat(tagLengthNode.asString()).isEqualTo("128");
318331

319-
// Oid under BlockCipher
320-
INode oidNode2 = blockCipherNode1.getChildren().get(Oid.class);
321-
assertThat(oidNode2).isNotNull();
322-
assertThat(oidNode2.getChildren()).isEmpty();
323-
assertThat(oidNode2.asString()).isEqualTo("2.16.840.1.101.3.4.1");
332+
// Oid under AuthenticatedEncryption
333+
INode oidNode = authenticatedEncryptionNode.getChildren().get(Oid.class);
334+
assertThat(oidNode).isNotNull();
335+
assertThat(oidNode.getChildren()).isEmpty();
336+
assertThat(oidNode.asString()).isEqualTo("2.16.840.1.101.3.4.1");
324337

325-
// Decrypt under BlockCipher
326-
INode decryptNode = blockCipherNode1.getChildren().get(Decrypt.class);
338+
// Decrypt under AuthenticatedEncryption
339+
INode decryptNode = authenticatedEncryptionNode.getChildren().get(Decrypt.class);
327340
assertThat(decryptNode).isNotNull();
328341
assertThat(decryptNode.getChildren()).isEmpty();
329342
assertThat(decryptNode.asString()).isEqualTo("DECRYPT");
330343

331-
// SecretKey under BlockCipher
332-
INode secretKeyNode2 = blockCipherNode1.getChildren().get(SecretKey.class);
333-
assertThat(secretKeyNode2).isNotNull();
334-
assertThat(secretKeyNode2.getChildren()).hasSize(1);
335-
assertThat(secretKeyNode2.asString()).isEqualTo("AES");
336-
337-
// BlockCipher under SecretKey under BlockCipher
338-
INode blockCipherNode2 = secretKeyNode2.getChildren().get(BlockCipher.class);
339-
assertThat(blockCipherNode2).isNotNull();
340-
assertThat(blockCipherNode2.getChildren()).hasSize(4);
341-
assertThat(blockCipherNode2.asString()).isEqualTo("AES128");
342-
343-
// Oid under BlockCipher under SecretKey under BlockCipher
344-
INode oidNode3 = blockCipherNode2.getChildren().get(Oid.class);
345-
assertThat(oidNode3).isNotNull();
346-
assertThat(oidNode3.getChildren()).isEmpty();
347-
assertThat(oidNode3.asString()).isEqualTo("2.16.840.1.101.3.4.1");
348-
349-
// KeyGeneration under BlockCipher under SecretKey under BlockCipher
350-
INode keyGenerationNode2 = blockCipherNode2.getChildren().get(KeyGeneration.class);
351-
assertThat(keyGenerationNode2).isNotNull();
352-
assertThat(keyGenerationNode2.getChildren()).isEmpty();
353-
assertThat(keyGenerationNode2.asString()).isEqualTo("KEYGENERATION");
354-
355-
// KeyLength under BlockCipher under SecretKey under BlockCipher
356-
INode keyLengthNode2 = blockCipherNode2.getChildren().get(KeyLength.class);
357-
assertThat(keyLengthNode2).isNotNull();
358-
assertThat(keyLengthNode2.getChildren()).isEmpty();
359-
assertThat(keyLengthNode2.asString()).isEqualTo("128");
360-
361-
// BlockSize under BlockCipher under SecretKey under BlockCipher
362-
INode blockSizeNode2 = blockCipherNode2.getChildren().get(BlockSize.class);
363-
assertThat(blockSizeNode2).isNotNull();
364-
assertThat(blockSizeNode2.getChildren()).isEmpty();
365-
assertThat(blockSizeNode2.asString()).isEqualTo("128");
366-
367-
// KeyLength under BlockCipher
368-
INode keyLengthNode3 = blockCipherNode1.getChildren().get(KeyLength.class);
369-
assertThat(keyLengthNode3).isNotNull();
370-
assertThat(keyLengthNode3.getChildren()).isEmpty();
371-
assertThat(keyLengthNode3.asString()).isEqualTo("128");
372-
373-
// BlockSize under BlockCipher
374-
INode blockSizeNode3 = blockCipherNode1.getChildren().get(BlockSize.class);
375-
assertThat(blockSizeNode3).isNotNull();
376-
assertThat(blockSizeNode3.getChildren()).isEmpty();
377-
assertThat(blockSizeNode3.asString()).isEqualTo("128");
344+
// Mode under AuthenticatedEncryption
345+
INode modeNode = authenticatedEncryptionNode.getChildren().get(Mode.class);
346+
assertThat(modeNode).isNotNull();
347+
assertThat(modeNode.getChildren()).isEmpty();
348+
assertThat(modeNode.asString()).isEqualTo("GCM");
349+
350+
// SecretKey under AuthenticatedEncryption
351+
INode secretKeyNode = authenticatedEncryptionNode.getChildren().get(SecretKey.class);
352+
assertThat(secretKeyNode).isNotNull();
353+
assertThat(secretKeyNode.getChildren()).hasSize(1);
354+
assertThat(secretKeyNode.asString()).isEqualTo("AES");
355+
356+
// BlockCipher under SecretKey under AuthenticatedEncryption
357+
INode blockCipherNode = secretKeyNode.getChildren().get(BlockCipher.class);
358+
assertThat(blockCipherNode).isNotNull();
359+
assertThat(blockCipherNode.getChildren()).hasSize(4);
360+
assertThat(blockCipherNode.asString()).isEqualTo("AES128");
361+
362+
// KeyLength under BlockCipher under SecretKey under AuthenticatedEncryption
363+
INode keyLengthNode1 = blockCipherNode.getChildren().get(KeyLength.class);
364+
assertThat(keyLengthNode1).isNotNull();
365+
assertThat(keyLengthNode1.getChildren()).isEmpty();
366+
assertThat(keyLengthNode1.asString()).isEqualTo("128");
367+
368+
// Oid under BlockCipher under SecretKey under AuthenticatedEncryption
369+
INode oidNode1 = blockCipherNode.getChildren().get(Oid.class);
370+
assertThat(oidNode1).isNotNull();
371+
assertThat(oidNode1.getChildren()).isEmpty();
372+
assertThat(oidNode1.asString()).isEqualTo("2.16.840.1.101.3.4.1");
373+
374+
// KeyGeneration under BlockCipher under SecretKey under AuthenticatedEncryption
375+
INode keyGenerationNode = blockCipherNode.getChildren().get(KeyGeneration.class);
376+
assertThat(keyGenerationNode).isNotNull();
377+
assertThat(keyGenerationNode.getChildren()).isEmpty();
378+
assertThat(keyGenerationNode.asString()).isEqualTo("KEYGENERATION");
379+
380+
// BlockSize under BlockCipher under SecretKey under AuthenticatedEncryption
381+
INode blockSizeNode = blockCipherNode.getChildren().get(BlockSize.class);
382+
assertThat(blockSizeNode).isNotNull();
383+
assertThat(blockSizeNode.getChildren()).isEmpty();
384+
assertThat(blockSizeNode.asString()).isEqualTo("128");
385+
386+
// BlockSize under AuthenticatedEncryption
387+
INode blockSizeNode1 = authenticatedEncryptionNode.getChildren().get(BlockSize.class);
388+
assertThat(blockSizeNode1).isNotNull();
389+
assertThat(blockSizeNode1.getChildren()).isEmpty();
390+
assertThat(blockSizeNode1.asString()).isEqualTo("128");
378391
}
379392
}
380393
}

0 commit comments

Comments
 (0)