Crypto: Adding bad decrypt then mac order query.

[bdrodes]

Adds capability to detect decrypt THEN mac. Also fixes to improve reuse of plaintext for mac and encryption.

[Copilot]

Pull Request Overview

This PR adds detection capability for the "decrypt-then-MAC" vulnerability pattern, where decryption occurs before MAC verification. The changes introduce a new query to identify this security issue and refactor existing code to improve reuse of plaintext tracking for both MAC and encryption operations.

Key changes:

• Adds new query BadMacOrderDecryptThenMac.ql to detect unsafe decrypt-then-MAC ordering
• Refactors wrapper argument tracking logic with new predicates (encryptWrapperArg, decryptWrapperArg, macWrapperArg)
• Renames InterimArg to EncryptOrMacCallArg and TargetArg to improve code clarity

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
BadMacUse.java	Adds test case decryptThenMac() demonstrating the unsafe decrypt-then-MAC pattern
BadMacOrderMacOnEncryptPlaintext.expected	Updates test expectations for plaintext reuse detection with new flow paths
BadMacOrderDecryptToMac.expected	Adds test failure expectation for missing source annotation
BadMacOrderDecryptThenMac.qlref	Creates query reference file for the new decrypt-then-MAC detection query
BadMacOrderDecryptThenMac.expected	Defines expected test results for the new decrypt-then-MAC query
BadMacOrderMacOnEncryptPlaintext.ql	Updates variable name from InterimArg to EncryptOrMacCallArg
BadMacOrderDecryptThenMac.ql	Implements new query to detect decrypt-then-MAC vulnerability pattern
BadMacOrder.qll	Refactors core logic with new wrapper predicates and flow configurations
not_included_in_qls.expected	Registers the new query in the excluded queries list

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Corrected spelling of 'ciopher' to 'cipher'.

Suggested change

	* @description Decryption on cipher text, then MAC on ciopher text, is incorrect order
	* @description Decryption on cipher text, then MAC on cipher text, is incorrect order

[Copilot]

The commented-out class EncryptOrMacPartialFlowArg should be removed if it's no longer needed. Leaving dead code in the codebase reduces maintainability and can cause confusion.

Suggested change

	// /**
	// * An argument of a target sink or a parent call whose parameter flows to a target sink
	// */
	// class EncryptOrMacPartialFlowArg extends DataFlow::Node {
	// DataFlow::Node targetSink;
	// EncryptOrMacPartialFlowArg() {
	// encryptWrapperArg(this, targetSink)
	// or
	// macWrapperArg(this, targetSink)
	// }
	// DataFlow::Node getTargetSink() { result = targetSink }
	// }