Skip to content

Commit b90a404

Browse files
michaelnebelmichaelnebel
authored
Merge pull request #9636 from michaelnebel/csharp/sinkmodelcsv
C#: Convert Sinks to CSV format for SymmetricAlgorithm.
2 parents fdcb1fa + 6603024 commit b90a404

File tree

5 files changed

+60
-39
lines changed

5 files changed

+60
-39
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -377,6 +377,7 @@ module CsvValidation {
377377
exists(string row, string kind | sinkModel(row) |
378378
kind = row.splitAt(";", 7) and
379379
not kind = ["code", "sql", "xss", "remote", "html"] and
380+
not kind.matches("encryption-%") and
380381
msg = "Invalid kind \"" + kind + "\" in sink model."
381382
)
382383
or

‎csharp/ql/lib/semmle/code/csharp/frameworks/system/security/Cryptography.qll‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,23 @@ private class SystemSecurityCryptographyOidCollectionFlowModelCsv extends Summar
4242
]
4343
}
4444
}
45+
46+
/** Sinks for `System.Security.Cryptography`. */
47+
private class SystemSecurityCryptographySinkModelCsv extends SinkModelCsv {
48+
override predicate row(string row) {
49+
row =
50+
[
51+
"System.Security.Cryptography;SymmetricAlgorithm;true;CreateEncryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-encryptor;manual",
52+
"System.Security.Cryptography;SymmetricAlgorithm;true;CreateDecryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-decryptor;manual",
53+
"System.Security.Cryptography;SymmetricAlgorithm;true;set_Key;(System.Byte[]);;Argument[0];encryption-keyprop;manual",
54+
]
55+
}
56+
}
57+
58+
/** Sinks for `Windows.Security.Cryptography.Core`. */
59+
private class WindowsSecurityCryptographyCoreSinkModelCsv extends SinkModelCsv {
60+
override predicate row(string row) {
61+
row =
62+
"Windows.Security.Cryptography.Core;SymmetricKeyAlgorithmProvider;false;CreateSymmetricKey;(Windows.Storage.Streams.IBuffer);;Argument[0];encryption-symmetrickey;manual"
63+
}
64+
}

‎csharp/ql/lib/semmle/code/csharp/security/cryptography/HardcodedSymmetricEncryptionKey.qll‎

Lines changed: 12 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
*/
55

66
import csharp
7+
private import semmle.code.csharp.dataflow.ExternalFlow
78

89
module HardcodedSymmetricEncryptionKey {
910
private import semmle.code.csharp.frameworks.system.security.cryptography.SymmetricAlgorithm
@@ -38,45 +39,20 @@ module HardcodedSymmetricEncryptionKey {
3839
StringLiteralSource() { this.asExpr() instanceof StringLiteral }
3940
}
4041

41-
private class SymmetricEncryptionKeyPropertySink extends Sink {
42-
SymmetricEncryptionKeyPropertySink() {
43-
this.asExpr() = any(SymmetricAlgorithm sa).getKeyProperty().getAnAssignedValue()
44-
}
45-
46-
override string getDescription() { result = "'Key' property assignment" }
47-
}
48-
49-
private class SymmetricEncryptionCreateEncryptorSink extends Sink {
50-
SymmetricEncryptionCreateEncryptorSink() {
51-
exists(SymmetricAlgorithm ag, MethodCall mc | mc = ag.getASymmetricEncryptor() |
52-
this.asExpr() = mc.getArgumentForName("rgbKey")
53-
)
54-
}
55-
56-
override string getDescription() { result = "Encryptor(rgbKey, IV)" }
57-
}
42+
private class SymmetricAlgorithmSink extends Sink {
43+
private string kind;
5844

59-
private class SymmetricEncryptionCreateDecryptorSink extends Sink {
60-
SymmetricEncryptionCreateDecryptorSink() {
61-
exists(SymmetricAlgorithm ag, MethodCall mc | mc = ag.getASymmetricDecryptor() |
62-
this.asExpr() = mc.getArgumentForName("rgbKey")
63-
)
64-
}
45+
SymmetricAlgorithmSink() { sinkNode(this, kind) and kind.matches("encryption%") }
6546

66-
override string getDescription() { result = "Decryptor(rgbKey, IV)" }
67-
}
68-
69-
private class CreateSymmetricKeySink extends Sink {
70-
CreateSymmetricKeySink() {
71-
exists(MethodCall mc, Method m |
72-
mc.getTarget() = m and
73-
m.hasQualifiedName("Windows.Security.Cryptography.Core.SymmetricKeyAlgorithmProvider",
74-
"CreateSymmetricKey") and
75-
this.asExpr() = mc.getArgumentForName("keyMaterial")
76-
)
47+
override string getDescription() {
48+
kind = "encryption-encryptor" and result = "Encryptor(rgbKey, IV)"
49+
or
50+
kind = "encryption-decryptor" and result = "Decryptor(rgbKey, IV)"
51+
or
52+
kind = "encryption-symmetrickey" and result = "CreateSymmetricKey(IBuffer keyMaterial)"
53+
or
54+
kind = "encryption-keyprop" and result = "'Key' property assignment"
7755
}
78-
79-
override string getDescription() { result = "CreateSymmetricKey(IBuffer keyMaterial)" }
8056
}
8157

8258
private class CryptographicBuffer extends Class {

‎csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.cs‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,36 @@ static void Main(string[] args)
4646
// GOOD (this function hashes password)
4747
var de = DecryptWithPassword(ct, c, iv);
4848

49+
// BAD: hard-coded password passed to Decrypt
50+
var de1 = Decrypt(ct, c, iv);
51+
4952
// BAD [NOT DETECTED]
5053
CreateCryptographicKey(null, byteArrayFromString);
5154

5255
// GOOD
5356
CreateCryptographicKey(null, File.ReadAllBytes("secret.key"));
5457
}
5558

59+
public static string Decrypt(byte[] cipherText, byte[] password, byte[] IV)
60+
{
61+
byte[] rawPlaintext;
62+
var salt = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 };
63+
64+
using (Aes aes = new AesManaged())
65+
{
66+
using (MemoryStream ms = new MemoryStream())
67+
{
68+
using (CryptoStream cs = new CryptoStream(ms, aes.CreateDecryptor(password, IV), CryptoStreamMode.Write))
69+
{
70+
cs.Write(cipherText, 0, cipherText.Length);
71+
}
72+
rawPlaintext = ms.ToArray();
73+
}
74+
75+
return Encoding.Unicode.GetString(rawPlaintext);
76+
}
77+
}
78+
5679
public static string DecryptWithPassword(byte[] cipherText, byte[] password, byte[] IV)
5780
{
5881
byte[] rawPlaintext;

‎csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.expected‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
| HardcodedSymmetricEncryptionKey.cs:17:21:17:97 | array creation of type Byte[] | Hard-coded symmetric $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:17:21:17:97 | array creation of type Byte[] | key |
22
| HardcodedSymmetricEncryptionKey.cs:22:23:22:99 | array creation of type Byte[] | Hard-coded symmetric $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:22:23:22:99 | array creation of type Byte[] | key |
33
| HardcodedSymmetricEncryptionKey.cs:31:21:31:21 | access to local variable d | Hard-coded symmetric $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | key |
4-
| HardcodedSymmetricEncryptionKey.cs:85:23:85:25 | access to parameter key | Hard-coded symmetric $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | key |
5-
| HardcodedSymmetricEncryptionKey.cs:98:87:98:89 | access to parameter key | Hard-coded symmetric $@ is used in symmetric algorithm in Encryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | key |
6-
| HardcodedSymmetricEncryptionKey.cs:98:87:98:89 | access to parameter key | Hard-coded symmetric $@ is used in symmetric algorithm in Encryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:28:62:28:115 | "Hello, world: here is a very bad way to create a key" | key |
4+
| HardcodedSymmetricEncryptionKey.cs:68:87:68:94 | access to parameter password | Hard-coded symmetric $@ is used in symmetric algorithm in Decryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | key |
5+
| HardcodedSymmetricEncryptionKey.cs:108:23:108:25 | access to parameter key | Hard-coded symmetric $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | key |
6+
| HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key | Hard-coded symmetric $@ is used in symmetric algorithm in Encryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | key |
7+
| HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key | Hard-coded symmetric $@ is used in symmetric algorithm in Encryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:28:62:28:115 | "Hello, world: here is a very bad way to create a key" | key |

0 commit comments

Comments
 (0)