Skip to content

Commit f6dce46

Browse files
authored
Merge pull request #22009 from geoffw0/rust-crypto
Rust: Additional test cases for rust/weak-sensitive-data-hashing
2 parents ec91865 + 9e0e1bd commit f6dce46

4 files changed

Lines changed: 99 additions & 9 deletions

File tree

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
| test.rs:19:9:19:34 | ...::compute(...) | HashingAlgorithm MD5 WEAK inputs:1 |
2+
| test.rs:20:9:20:40 | ...::compute(...) | HashingAlgorithm MD5 WEAK inputs:1 |
3+
| test.rs:21:9:21:34 | ...::compute(...) | HashingAlgorithm MD5 WEAK inputs:1 |
4+
| test.rs:22:9:22:44 | ...::compute(...) | HashingAlgorithm MD5 WEAK inputs:1 |
5+
| test.rs:67:26:67:40 | ...::new(...) | HashingAlgorithm MD5 WEAK |
6+
| test.rs:73:9:73:23 | ...::new(...) | HashingAlgorithm MD5 WEAK |
7+
| test.rs:74:9:74:23 | ...::new(...) | HashingAlgorithm MD5 WEAK |
8+
| test.rs:133:26:133:40 | ...::new(...) | HashingAlgorithm MD5 WEAK |
9+
| test.rs:156:26:156:40 | ...::new(...) | HashingAlgorithm MD5 WEAK |
10+
| test.rs:176:13:176:24 | ...::new(...) | EncryptionAlgorithm SEED |
11+
| test.rs:199:22:199:32 | ...::new(...) | HashingAlgorithm SHA1 WEAK |
12+
| test.rs:211:13:211:35 | ...::compute(...) | HashingAlgorithm MD5 WEAK inputs:1 |
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
query: queries/summary/CryptographicOperations.ql
2+
postprocess:
3+
- utils/test/InlineExpectationsTestQuery.ql
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,22 @@
11
#select
22
| test.rs:20:9:20:24 | ...::compute | test.rs:20:26:20:39 | credit_card_no | test.rs:20:9:20:24 | ...::compute | $@ is used in a hashing algorithm (MD5) that is insecure. | test.rs:20:26:20:39 | credit_card_no | Sensitive data (private) |
33
| test.rs:21:9:21:24 | ...::compute | test.rs:21:26:21:33 | password | test.rs:21:9:21:24 | ...::compute | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:21:26:21:33 | password | Sensitive data (password) |
4+
| test.rs:211:13:211:28 | ...::compute | test.rs:226:29:226:36 | password | test.rs:211:13:211:28 | ...::compute | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:226:29:226:36 | password | Sensitive data (password) |
45
edges
56
| test.rs:20:26:20:39 | credit_card_no | test.rs:20:9:20:24 | ...::compute | provenance | MaD:1 Sink:MaD:1 |
67
| test.rs:21:26:21:33 | password | test.rs:21:9:21:24 | ...::compute | provenance | MaD:1 Sink:MaD:1 |
8+
| test.rs:210:20:210:30 | ...: ... | test.rs:211:30:211:34 | value | provenance | |
9+
| test.rs:211:30:211:34 | value | test.rs:211:13:211:28 | ...::compute | provenance | MaD:1 Sink:MaD:1 |
10+
| test.rs:226:29:226:36 | password | test.rs:210:20:210:30 | ...: ... | provenance | |
711
models
812
| 1 | Sink: md5::compute; Argument[0]; hasher-input |
913
nodes
1014
| test.rs:20:9:20:24 | ...::compute | semmle.label | ...::compute |
1115
| test.rs:20:26:20:39 | credit_card_no | semmle.label | credit_card_no |
1216
| test.rs:21:9:21:24 | ...::compute | semmle.label | ...::compute |
1317
| test.rs:21:26:21:33 | password | semmle.label | password |
18+
| test.rs:210:20:210:30 | ...: ... | semmle.label | ...: ... |
19+
| test.rs:211:13:211:28 | ...::compute | semmle.label | ...::compute |
20+
| test.rs:211:30:211:34 | value | semmle.label | value |
21+
| test.rs:226:29:226:36 | password | semmle.label | password |
1422
subpaths

rust/ql/test/query-tests/security/CWE-327/WeakSensitiveDataHashing/test.rs

Lines changed: 76 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ fn test_hash_algorithms(
1616
_ = md5::Md5::digest(encrypted_password);
1717

1818
// MD5 (alternative / older library)
19-
_ = md5_alt::compute(harmless);
20-
_ = md5_alt::compute(credit_card_no); // $ Alert[rust/weak-sensitive-data-hashing]
21-
_ = md5_alt::compute(password); // $ Alert[rust/weak-sensitive-data-hashing]
22-
_ = md5_alt::compute(encrypted_password);
19+
_ = md5_alt::compute(harmless); // $ Alert[rust/summary/cryptographic-operations]
20+
_ = md5_alt::compute(credit_card_no); // $ Alert[rust/summary/cryptographic-operations] Alert[rust/weak-sensitive-data-hashing]
21+
_ = md5_alt::compute(password); // $ Alert[rust/summary/cryptographic-operations] Alert[rust/weak-sensitive-data-hashing]
22+
_ = md5_alt::compute(encrypted_password); // $ Alert[rust/summary/cryptographic-operations]
2323

2424
// SHA-1
2525
_ = sha1::Sha1::digest(harmless);
@@ -64,14 +64,14 @@ fn test_hash_code_patterns(
6464
_ = md5::Md5::digest(password_vec); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
6565

6666
// hash through a hasher object
67-
let mut md5_hasher = md5::Md5::new();
67+
let mut md5_hasher = md5::Md5::new(); // $ Alert[rust/summary/cryptographic-operations]
6868
md5_hasher.update(b"abc");
6969
md5_hasher.update(harmless);
7070
md5_hasher.update(password); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
7171
_ = md5_hasher.finalize();
7272

73-
_ = md5::Md5::new().chain_update(harmless).chain_update(harmless).chain_update(harmless).finalize();
74-
_ = md5::Md5::new().chain_update(harmless).chain_update(password).chain_update(harmless).finalize(); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
73+
_ = md5::Md5::new().chain_update(harmless).chain_update(harmless).chain_update(harmless).finalize(); // $ Alert[rust/summary/cryptographic-operations]
74+
_ = md5::Md5::new().chain_update(harmless).chain_update(password).chain_update(harmless).finalize(); // $ Alert[rust/summary/cryptographic-operations] MISSING: Alert[rust/weak-sensitive-data-hashing]
7575

7676
_ = md5::Md5::new_with_prefix(harmless).finalize();
7777
_ = md5::Md5::new_with_prefix(password).finalize(); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
@@ -130,7 +130,7 @@ fn test_hash_structs() {
130130
let str3c = serde_urlencoded::to_string(&s3).unwrap();
131131

132132
// hash with MD5
133-
let mut md5_hasher = md5::Md5::new();
133+
let mut md5_hasher = md5::Md5::new(); // $ Alert[rust/summary/cryptographic-operations]
134134
md5_hasher.update(s1.data);
135135
md5_hasher.update(s2.credit_card_no); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
136136
md5_hasher.update(s3.password); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
@@ -153,8 +153,75 @@ fn test_hash_file(
153153
let mut harmless_file = std::fs::File::open(harmless_filename).unwrap();
154154
let mut password_file = std::fs::File::open(password_filename).unwrap();
155155

156-
let mut md5_hasher = md5::Md5::new();
156+
let mut md5_hasher = md5::Md5::new(); // $ Alert[rust/summary/cryptographic-operations]
157157
_ = std::io::copy(&mut harmless_file, &mut md5_hasher);
158158
_ = std::io::copy(&mut password_file, &mut md5_hasher); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
159159
_ = md5_hasher.finalize();
160160
}
161+
162+
// ---
163+
164+
struct Seed {
165+
}
166+
167+
impl Seed {
168+
fn new(_seed_value: u64) -> Self {
169+
Seed { }
170+
}
171+
}
172+
173+
fn test_seed() {
174+
// this will be misrecognized as a use of the SEED algorithm, but SEED is strong and the input
175+
// is not sensitive data, so `rust/weak-sensitive-data-hashing` should not report a result here.
176+
let _ = Seed::new(0); // $ Alert[rust/summary/cryptographic-operations]
177+
}
178+
179+
// ---
180+
181+
struct Sha1 {
182+
}
183+
184+
impl Sha1 {
185+
const fn new() -> Self {
186+
Sha1 { }
187+
}
188+
189+
const fn update(&mut self, _data: &[u8]) {
190+
// ...
191+
}
192+
193+
const fn finalize(self) -> [u8; 20] {
194+
[0; 20]
195+
}
196+
}
197+
198+
fn sha1_test(password: &[u8]) {
199+
let mut hasher = Sha1::new(); // $ Alert[rust/summary/cryptographic-operations]
200+
hasher.update(password); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
201+
_ = hasher.finalize();
202+
}
203+
204+
// ---
205+
206+
struct HashCollection {
207+
}
208+
209+
impl HashCollection {
210+
pub fn add_sig(value: &str) -> Self {
211+
_ = md5_alt::compute(value); // $ Alert[rust/summary/cryptographic-operations] Alert[rust/weak-sensitive-data-hashing]
212+
213+
// ...
214+
215+
HashCollection { }
216+
}
217+
}
218+
219+
fn test_hash_collection() {
220+
// this indirectly performs MD5 hashing, but the data is not sensitive
221+
let id: &str = "my_id_1234567890";
222+
HashCollection::add_sig(id);
223+
224+
// this indirectly performs MD5 hashing, and the data is sensitive; the result is reported here
225+
let password: &str = "password123";
226+
HashCollection::add_sig(password); // $ Source
227+
}

0 commit comments

Comments
 (0)