|
2 | 2 | * Provides classes for modeling cryptographic libraries. |
3 | 3 | */ |
4 | 4 |
|
5 | | -/* |
6 | | - * The following information is copied from `/semmlecode-javascript-queries/semmle/javascript/frameworks/CryptoLibraries.qll` |
7 | | - * which should be considered the definitive version (as of Feb 2018) |
8 | | - */ |
9 | | - |
10 | 5 | /** |
11 | 6 | * Names of cryptographic algorithms, separated into strong and weak variants. |
12 | 7 | * |
13 | 8 | * The names are normalized: upper-case, no spaces, dashes or underscores. |
14 | 9 | * |
15 | 10 | * The names are inspired by the names used in real world crypto libraries. |
| 11 | + * |
| 12 | + * The classification into strong and weak are based on Wikipedia, OWASP and google (2017). |
16 | 13 | */ |
17 | 14 | private module AlgorithmNames { |
18 | 15 | predicate isStrongHashingAlgorithm(string name) { |
@@ -81,14 +78,6 @@ private module AlgorithmNames { |
81 | 78 | } |
82 | 79 |
|
83 | 80 | predicate isWeakPasswordHashingAlgorithm(string name) { none() } |
84 | | - |
85 | | - /** |
86 | | - * Normalizes `name`: upper-case, no spaces, dashes or underscores. |
87 | | - * |
88 | | - * All names of this module are in this normalized form. |
89 | | - */ |
90 | | - bindingset[name] |
91 | | - string normalizeName(string name) { result = name.toUpperCase().regexpReplaceAll("[-_ ]", "") } |
92 | 81 | } |
93 | 82 |
|
94 | 83 | private import AlgorithmNames |
@@ -121,10 +110,19 @@ abstract class CryptographicAlgorithm extends TCryptographicAlgorithm { |
121 | 110 | string toString() { result = getName() } |
122 | 111 |
|
123 | 112 | /** |
124 | | - * Gets the name of the algorithm. |
| 113 | + * Gets the name of this algorithm. |
125 | 114 | */ |
126 | 115 | abstract string getName(); |
127 | 116 |
|
| 117 | + /** |
| 118 | + * Holds if the name of this algorithm matches `name` modulo case, |
| 119 | + * white space, dashes and underscores. |
| 120 | + */ |
| 121 | + bindingset[name] |
| 122 | + predicate matchesName(string name) { |
| 123 | + name.toUpperCase().regexpReplaceAll("[-_ ]", "") = getName() |
| 124 | + } |
| 125 | + |
128 | 126 | /** |
129 | 127 | * Holds if this algorithm is weak. |
130 | 128 | */ |
|
0 commit comments