Skip to content

Commit 4ca54e9

Browse files
chanel-ychanel-y
committed
moved crypto classes/methods to folder under lib
1 parent 6648a6f commit 4ca54e9

13 files changed

Lines changed: 364 additions & 214 deletions

File tree

‎powershell/ql/lib/semmle/code/powershell/security/cryptography/Concepts.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
import CryptoAlgorithmNames
2+
import CryptoArtifact
3+
4+
import CryptographyModule

‎powershell/ql/lib/semmle/code/powershell/security/cryptography/CryptoAlgorithmNames.qll‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
predicate isHashingAlgorithm(string name) {
2+
name = [
3+
"blake2", "blake2b", "blake2s", "sha2", "sha224", "sha256", "sha384", "sha512", "sha512224",
4+
"sha512256", "sha3", "sha3224", "sha3256", "sha3384", "sha3512", "shake128", "shake256",
5+
"sm3", "whirlpool", "poly1305", "havel128", "md2", "md4", "md5", "panama", "ripemd",
6+
"ripemd128", "ripemd256", "ripemd160", "ripemd320", "sha0", "sha1", "sha", "mgf1", "mgf1sha1",
7+
"mdc2", "siphash"
8+
]
9+
}
10+
11+
predicate isSymmetricAlgorithm(string name) {
12+
name = [
13+
"aes", "aes128", "aes192", "aes256", "aria", "blowfish", "bf", "ecies", "cast", "cast5",
14+
"camellia", "camellia128", "camellia192", "camellia256", "chacha", "chacha20",
15+
"chacha20poly1305", "gost", "gostr34102001", "gostr341094", "gostr341194", "gost2814789",
16+
"gostr341194", "gost2814789", "gost28147", "gostr341094", "gost89", "gost94", "gost34102012",
17+
"gost34112012", "idea", "rabbit", "seed", "sm4", "des", "desx", "3des", "tdes", "2des",
18+
"des3", "tripledes", "tdea", "tripledea", "arc2", "rc2", "arc4", "rc4", "arcfour", "arc5",
19+
"rc5", "magma", "kuznyechik"
20+
]
21+
}
22+
23+
predicate isCipherBlockModeAlgorithm(string name) {
24+
name = ["cbc", "gcm", "ccm", "cfb", "ofb", "cfb8", "ctr", "openpgp", "xts", "eax", "siv", "ecb"]
25+
}
26+
27+
string unknownAlgorithm() { result = "UNKNOWN" }

‎powershell/ql/lib/semmle/code/powershell/security/cryptography/CryptoArtifact.qll‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
import powershell
2+
import CryptoAlgorithmNames
3+
import semmle.code.powershell.dataflow.DataFlow
4+
5+
/*
6+
* A cryptographic artifact is a DataFlow::Node associated with some
7+
* operation, algorithm, or any other aspect of cryptography.
8+
*/
9+
10+
abstract class CryptographicArtifact extends DataFlow::Node { }
11+
12+
abstract class CryptographicAlgorithm extends CryptographicArtifact {
13+
abstract string getName();
14+
}
15+
16+
abstract class HashAlgorithm extends CryptographicAlgorithm {
17+
final string getHashName() {
18+
if exists(string n | n = this.getName() and isHashingAlgorithm(n))
19+
then isHashingAlgorithm(result) and result = this.getName()
20+
else result = unknownAlgorithm()
21+
}
22+
}
23+
24+
abstract class SymmetricAlgorithm extends CryptographicAlgorithm {
25+
final string getSymmetricAlgorithmName() {
26+
if exists(string n | n = this.getName() and isSymmetricAlgorithm(n))
27+
then isSymmetricAlgorithm(result) and result = this.getName()
28+
else result = unknownAlgorithm()
29+
}
30+
}
31+
32+
abstract class BlockMode extends CryptographicAlgorithm {
33+
final string getBlockModeName() {
34+
if exists(string n | n = this.getName() and isCipherBlockModeAlgorithm(n))
35+
then isCipherBlockModeAlgorithm(result) and result = this.getName()
36+
else result = unknownAlgorithm()
37+
}
38+
}

‎powershell/ql/lib/semmle/code/powershell/security/cryptography/CryptographyModule.qll‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
import powershell
2+
import semmle.code.powershell.dataflow.DataFlow
3+
import semmle.code.powershell.ApiGraphs
4+
5+
import CryptoArtifact
6+
7+
class CryptoAlgorithmObjectCreation extends DataFlow::ObjectCreationNode {
8+
string objectName;
9+
CryptoAlgorithmObjectCreation(){
10+
objectName = this.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString().toLowerCase()
11+
}
12+
string getObjectName() {
13+
result = objectName
14+
}
15+
}
16+
17+
class CryptoAlgorithmCreateCall extends DataFlow::CallNode {
18+
string objectName;
19+
CryptoAlgorithmCreateCall() {
20+
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember(objectName).getMember("create").asCall()
21+
}
22+
23+
string getObjectName() {
24+
result = objectName
25+
}
26+
}
27+
28+
class CryptoAlgorithmCreateArgCall extends DataFlow::CallNode {
29+
string objectName;
30+
CryptoAlgorithmCreateArgCall() {
31+
(
32+
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember(_).getMember("create").asCall() or
33+
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("create").asCall()
34+
) and
35+
objectName = this.getAnArgument().asExpr().getValue().asString().toLowerCase()
36+
}
37+
38+
string getObjectName() {
39+
result = objectName
40+
}
41+
}
42+
43+
44+
class CryptoAlgorithmCreateFromNameCall extends DataFlow::CallNode {
45+
string objectName;
46+
CryptoAlgorithmCreateFromNameCall() {
47+
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("cryptoconfig").getMember("createfromname").asCall() and
48+
objectName = this.getAnArgument().asExpr().getValue().asString().toLowerCase()
49+
}
50+
51+
string getObjectName() {
52+
result = objectName
53+
}
54+
}
55+
56+
class HashAlgorithmObjectCreation extends HashAlgorithm, CryptoAlgorithmObjectCreation {
57+
string algName;
58+
HashAlgorithmObjectCreation() {
59+
(
60+
this.getObjectName() = "system.security.cryptography." + algName or
61+
this.getObjectName() = "system.security.cryptography." + algName + "cryptoserviceprovider"
62+
)
63+
and
64+
isHashingAlgorithm(algName)
65+
}
66+
67+
override string getName() {
68+
result = algName
69+
}
70+
}
71+
72+
class HashAlgorithmCreateCall extends HashAlgorithm, CryptoAlgorithmCreateCall {
73+
string algName;
74+
HashAlgorithmCreateCall() {
75+
isHashingAlgorithm(this.getObjectName()) and
76+
(
77+
this.getObjectName() = algName or
78+
this.getObjectName() = "system.security.cryptography." + algName
79+
)
80+
}
81+
override string getName() {
82+
result = algName
83+
}
84+
}
85+
86+
class HashAlgorithmCreateFromNameCall extends HashAlgorithm, CryptoAlgorithmCreateFromNameCall {
87+
string algName;
88+
HashAlgorithmCreateFromNameCall() {
89+
(
90+
this.getObjectName() = algName or
91+
this.getObjectName() = "system.security.cryptography." + algName
92+
) and
93+
isHashingAlgorithm(algName)
94+
}
95+
96+
override string getName() {
97+
result = algName
98+
}
99+
}
100+
101+
class SymmetricAlgorithmObjectCreation extends SymmetricAlgorithm, CryptoAlgorithmObjectCreation {
102+
string algName;
103+
SymmetricAlgorithmObjectCreation() {
104+
(
105+
this.getObjectName() = "system.security.cryptography." + algName or
106+
this.getObjectName() = "system.security.cryptography." + algName + "cryptoserviceprovider" or
107+
this.getObjectName() = "system.security.cryptography.symmetricalgorithm." + algName
108+
)
109+
and
110+
isSymmetricAlgorithm(algName)
111+
}
112+
113+
override string getName() {
114+
result = algName
115+
}
116+
}
117+
118+
class SymmetricAlgorithmCreateCall extends SymmetricAlgorithm, CryptoAlgorithmCreateCall {
119+
string algName;
120+
SymmetricAlgorithmCreateCall() {
121+
isSymmetricAlgorithm(this.getObjectName()) and
122+
(
123+
this.getObjectName() = algName or
124+
this.getObjectName() = "system.security.cryptography." + algName or
125+
this.getObjectName() = "system.security.cryptography.symmetricalgorithm." + algName
126+
)
127+
}
128+
override string getName() {
129+
result = algName
130+
}
131+
}
132+
133+
class SymmetricAlgorithmCreateArgCall extends SymmetricAlgorithm, CryptoAlgorithmCreateArgCall {
134+
string algName;
135+
SymmetricAlgorithmCreateArgCall() {
136+
137+
(
138+
algName = this.getObjectName() and
139+
isSymmetricAlgorithm(algName)
140+
) or
141+
(
142+
this.getObjectName() = "system.security.cryptography." + algName and
143+
isSymmetricAlgorithm(algName)
144+
)
145+
}
146+
override string getName() {
147+
result = algName
148+
}
149+
}
150+
151+
class SymmetricAlgorithmCreateFromNameCall extends SymmetricAlgorithm, CryptoAlgorithmCreateFromNameCall {
152+
string algName;
153+
SymmetricAlgorithmCreateFromNameCall() {
154+
(
155+
this.getObjectName() = algName or
156+
this.getObjectName() = "system.security.cryptography." + algName or
157+
this.getObjectName() = "system.security.cryptography.symmetricalgorithm." + algName
158+
) and
159+
isSymmetricAlgorithm(algName)
160+
}
161+
162+
override string getName() {
163+
result = algName
164+
}
165+
}
166+
167+
class CipherBlockStringConstExpr extends BlockMode {
168+
string modeName;
169+
CipherBlockStringConstExpr() {
170+
exists(StringConstExpr s |
171+
s = this.asExpr().getExpr() and
172+
modeName = s.getValueString().toLowerCase() and
173+
isCipherBlockModeAlgorithm(modeName)
174+
)
175+
}
176+
override string getName() {
177+
result = modeName
178+
}
179+
}
180+
181+
class CipherBlockModeEnum extends BlockMode {
182+
string modeName;
183+
CipherBlockModeEnum() {
184+
exists(API::Node node |
185+
node =
186+
API::getTopLevelMember("system")
187+
.getMember("security")
188+
.getMember("cryptography")
189+
.getMember("ciphermode")
190+
.getMember(modeName) and
191+
this = node.asSource() and
192+
isCipherBlockModeAlgorithm(modeName)
193+
)
194+
}
195+
override string getName() {
196+
result = modeName
197+
}
198+
}

‎powershell/ql/src/queries/security/cwe-327/ApprovedCipherMode.ql‎

Lines changed: 5 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,9 @@ import powershell
1515
import semmle.code.powershell.dataflow.DataFlow
1616
import semmle.code.powershell.dataflow.TaintTracking
1717
import semmle.code.powershell.ApiGraphs
18+
import semmle.code.powershell.security.cryptography.Concepts
1819
import WeakEncryptionFlow::PathGraph
1920

20-
class AesCreation extends ObjectCreation {
21-
AesCreation() {
22-
this.getAnArgument().getValue().stringMatches("System.Security.Cryptography.AesManaged")
23-
}
24-
}
25-
2621
class AesModeProperty extends MemberExpr {
2722
AesModeProperty() {
2823
exists(DataFlow::ObjectCreationNode aesObjectCreation, DataFlow::Node aesObjectAccess |
@@ -38,27 +33,11 @@ class AesModeProperty extends MemberExpr {
3833
}
3934
}
4035

41-
class WeakAesMode extends DataFlow::Node {
42-
WeakAesMode() {
43-
exists(API::Node node, string modeValue |
44-
node =
45-
API::getTopLevelMember("system")
46-
.getMember("security")
47-
.getMember("cryptography")
48-
.getMember("ciphermode")
49-
.getMember(modeValue) and
50-
modeValue = ["ecb", "ofb", "cfb", "ctr", "obc"] and
51-
this = node.asSource()
52-
) or
53-
exists(StringConstExpr s |
54-
s.getValueString().toLowerCase() = ["ecb", "ofb", "cfb", "ctr", "obc"] and
55-
this.asExpr().getExpr() = s
56-
)
57-
}
58-
}
59-
6036
module Config implements DataFlow::ConfigSig {
61-
predicate isSource(DataFlow::Node source) { source instanceof WeakAesMode }
37+
predicate isSource(DataFlow::Node source) {
38+
source instanceof BlockMode and
39+
not source.(BlockMode).getBlockModeName() = ["cbc","cts","xts"]
40+
}
6241

6342
predicate isSink(DataFlow::Node sink) {
6443
sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr().getExpr() =

‎powershell/ql/src/queries/security/cwe-327/WeakHashes.ql‎

Lines changed: 5 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -14,50 +14,9 @@
1414
import powershell
1515
import semmle.code.powershell.ApiGraphs
1616
import semmle.code.powershell.dataflow.DataFlow
17+
import semmle.code.powershell.security.cryptography.Concepts
1718

18-
class WeakHashAlgorithmObjectCreation extends DataFlow::ObjectCreationNode {
19-
WeakHashAlgorithmObjectCreation() {
20-
this.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString() = "System.Security.Cryptography.MD5" or
21-
this.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString() = "System.Security.Cryptography.MD5CryptoServiceProvider" or
22-
this.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString() = "System.Security.Cryptography.SHA1" or
23-
this.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString() = "System.Security.Cryptography.SHA1CryptoServiceProvider" or
24-
this.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString() = "System.Security.Cryptography.SHA1Managed"
25-
}
26-
}
27-
28-
class WeakHashAlgorithmCreateCall extends DataFlow::CallNode {
29-
WeakHashAlgorithmCreateCall() {
30-
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("md5").getMember("create").asCall() or
31-
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("sha1").getMember("create").asCall()
32-
}
33-
}
34-
35-
class ComputeHashSink extends DataFlow::Node {
36-
ComputeHashSink() {
37-
exists(DataFlow::ObjectCreationNode ocn, DataFlow::CallNode cn |
38-
(
39-
ocn.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString() = "System.Security.Cryptography.SHA1Managed" or
40-
ocn.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString() = "System.Security.Cryptography.SHA1CryptoServiceProvider"
41-
) and
42-
cn.getQualifier().getALocalSource() = ocn and
43-
cn.getLowerCaseName() = "computehash" and
44-
cn.getAnArgument() = this
45-
)
46-
}
47-
}
48-
49-
class CreateFromNameSink extends DataFlow::CallNode {
50-
CreateFromNameSink(){
51-
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("cryptoconfig").getMember("createfromname").asCall() and
52-
this.getAnArgument().asExpr().getValue().asString() = "System.Security.Cryptography.MD5" or
53-
this.getAnArgument().asExpr().getValue().asString() = "MD5"
54-
55-
}
56-
}
57-
58-
from DataFlow::Node sink
59-
where sink instanceof ComputeHashSink or
60-
sink instanceof WeakHashAlgorithmObjectCreation or
61-
sink instanceof WeakHashAlgorithmCreateCall or
62-
sink instanceof CreateFromNameSink
63-
select sink, "Use of weak cryptographic hash algorithm."
19+
from HashAlgorithm hashAlg
20+
where
21+
not hashAlg.getHashName() = ["sha256", "sha384", "sha512"]
22+
select hashAlg, "Use of weak cryptographic hash algorithm: " + hashAlg.getHashName() + "."

0 commit comments

Comments
 (0)