Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Java: Make java/weak-cryptographic-algorithm give a reason why the algo is insecure #18161

Open
wants to merge 8 commits into
base: main
Choose a base branch
from

Conversation

owen-mc
Copy link
Contributor

@owen-mc owen-mc commented Nov 29, 2024

To do:

  • Check autofix still generates good alerts.
  • Make an internal companion PR to update the language test that is failing.

Pull Request checklist

All query authors

Internal query authors only

  • Autofixes generated based on these changes are valid, only needed if this PR makes significant changes to .ql, .qll, or .qhelp files. See the documentation (internal access required).
  • Changes are validated at scale (internal access required).
  • Adding a new query? Consider also adding the query to autofix.

@owen-mc owen-mc changed the title Java/weak crypto algo more informative Java: Make java/weak-cryptographic-algorithm give a reason why the algo is insecure Nov 29, 2024
@owen-mc owen-mc changed the title Java: Make java/weak-cryptographic-algorithm give a reason why the algo is insecure Java: Make java/weak-cryptographic-algorithm give a reason why the algo is insecure Nov 29, 2024
This changes the order of the algorithms in the regex, but I don't think
that makes any difference.
@owen-mc owen-mc force-pushed the java/weak-crypto-algo-more-informative branch from 399bcd6 to 95d26d9 Compare November 29, 2024 11:54
@owen-mc owen-mc marked this pull request as ready for review December 4, 2024 00:43
@owen-mc owen-mc requested a review from a team as a code owner December 4, 2024 00:43
smowton
smowton previously approved these changes Dec 4, 2024
Copy link
Contributor

@smowton smowton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Slight suggested tweak, otherwise LGTM

java/ql/lib/semmle/code/java/security/Encryption.qll Outdated Show resolved Hide resolved
joefarebrother
joefarebrother previously approved these changes Dec 4, 2024
Copy link
Contributor

@joefarebrother joefarebrother left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍

egregius313
egregius313 previously approved these changes Dec 4, 2024
Copy link
Contributor

@egregius313 egregius313 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@owen-mc owen-mc dismissed stale reviews from egregius313 and joefarebrother via 5959a73 January 7, 2025 16:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants