From b0839e9f1b4ccdba48c77bbc9fb816ed66740cf1 Mon Sep 17 00:00:00 2001 From: Sven Meyer Date: Sun, 26 Nov 2023 15:10:41 +0100 Subject: [PATCH] Fix issue 421: Consider all method calls, when predicates are checked --- .../crypto/analysis/errors/AbstractError.java | 5 +- .../crypto/constraints/ConstraintSolver.java | 37 ++++--- .../headless/BragaCryptoGoodusesTest.java | 62 +++++------ .../headless/BragaCryptoMisusesTest.java | 101 +++++++++--------- .../test/java/tests/pattern/IssuesTest.java | 40 +++++++ 5 files changed, 151 insertions(+), 94 deletions(-) create mode 100644 CryptoAnalysis/src/test/java/tests/pattern/IssuesTest.java diff --git a/CryptoAnalysis/src/main/java/crypto/analysis/errors/AbstractError.java b/CryptoAnalysis/src/main/java/crypto/analysis/errors/AbstractError.java index 22fa3359e..d27b9c775 100644 --- a/CryptoAnalysis/src/main/java/crypto/analysis/errors/AbstractError.java +++ b/CryptoAnalysis/src/main/java/crypto/analysis/errors/AbstractError.java @@ -83,8 +83,11 @@ public boolean equals(Object obj) { if (rule == null) { if (other.rule != null) return false; - } else if (!rule.equals(other.rule)) + } else if (!rule.equals(other.rule)) { return false; + } else if (!errorLocation.equals(other.getErrorLocation())) { + return false; + } return true; } } diff --git a/CryptoAnalysis/src/main/java/crypto/constraints/ConstraintSolver.java b/CryptoAnalysis/src/main/java/crypto/constraints/ConstraintSolver.java index 3362b146d..f142994d4 100644 --- a/CryptoAnalysis/src/main/java/crypto/constraints/ConstraintSolver.java +++ b/CryptoAnalysis/src/main/java/crypto/constraints/ConstraintSolver.java @@ -122,9 +122,11 @@ private void partitionConstraints() { if (involvedVarNames.isEmpty() || (cons.toString().contains("speccedKey") && involvedVarNames.size() == 1)) { if (cons instanceof CrySLPredicate) { - RequiredCrySLPredicate pred = retrieveValuesForPred(cons); - if (pred != null) { + List preds = retrieveValuesForPred(cons); + + for (RequiredCrySLPredicate pred : preds) { CrySLPredicate innerPred = pred.getPred(); + if (innerPred != null) { relConstraints.add(innerPred); requiredPredicates.add(pred); @@ -132,8 +134,9 @@ private void partitionConstraints() { } } else if (cons instanceof CrySLConstraint) { ISLConstraint left = ((CrySLConstraint) cons).getLeft(); + if (left instanceof CrySLPredicate && !predefinedPreds.contains(((CrySLPredicate) left).getPredName())) { - requiredPredicates.add(collectAlternativePredicates((CrySLConstraint) cons, null)); + requiredPredicates.addAll(collectAlternativePredicates((CrySLConstraint) cons, Lists.newArrayList())); } else { relConstraints.add(cons); } @@ -144,33 +147,40 @@ private void partitionConstraints() { } } - private ISLConstraint collectAlternativePredicates(CrySLConstraint cons, AlternativeReqPredicate alt) { + private List collectAlternativePredicates(CrySLConstraint cons, List alts) { CrySLPredicate left = (CrySLPredicate) cons.getLeft(); - if (alt == null) { + + if (alts.isEmpty()) { for (CallSiteWithParamIndex cwpi : this.getParameterAnalysisQuerySites()) { for (ICrySLPredicateParameter p : left.getParameters()) { if (p.getName().equals("transformation")) continue; if (cwpi.getVarName().equals(p.getName())) { - alt = new AlternativeReqPredicate(left, cwpi.stmt()); + alts.add(new AlternativeReqPredicate(left, cwpi.stmt())); } } } } else { - alt.addAlternative(left); + for (AlternativeReqPredicate alt : alts) { + alt.addAlternative(left); + } } if (cons.getRight() instanceof CrySLPredicate) { - alt.addAlternative((CrySLPredicate) cons.getRight()); + for (AlternativeReqPredicate alt : alts) { + alt.addAlternative((CrySLPredicate) cons.getRight()); + } } else { - return collectAlternativePredicates((CrySLConstraint) cons.getRight(), alt); + return collectAlternativePredicates((CrySLConstraint) cons.getRight(), alts); } - return alt; + return alts; } - private RequiredCrySLPredicate retrieveValuesForPred(ISLConstraint cons) { + private List retrieveValuesForPred(ISLConstraint cons) { CrySLPredicate pred = (CrySLPredicate) cons; + List result = Lists.newArrayList(); + for (CallSiteWithParamIndex cwpi : this.getParameterAnalysisQuerySites()) { for (ICrySLPredicateParameter p : pred.getParameters()) { // TODO: FIX Cipher rule @@ -184,10 +194,11 @@ private RequiredCrySLPredicate retrieveValuesForPred(ISLConstraint cons) { } if (cwpi.getVarName().equals(p.getName())) { - return new RequiredCrySLPredicate(pred, cwpi.stmt()); + result.add(new RequiredCrySLPredicate(pred, cwpi.stmt())); } } } - return null; + + return result; } } diff --git a/CryptoAnalysis/src/test/java/tests/headless/BragaCryptoGoodusesTest.java b/CryptoAnalysis/src/test/java/tests/headless/BragaCryptoGoodusesTest.java index 979510bdd..3a9d8e9f7 100644 --- a/CryptoAnalysis/src/test/java/tests/headless/BragaCryptoGoodusesTest.java +++ b/CryptoAnalysis/src/test/java/tests/headless/BragaCryptoGoodusesTest.java @@ -64,7 +64,7 @@ public void avoidCodingErrorsExamples() { setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ForbiddenMethodError.class, 1); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", IncompleteOperationError.class, 4); @@ -85,7 +85,7 @@ public void avoidConstantPwdPBEExamples() { HeadlessCryptoScanner scanner = createScanner(mavenProject); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ForbiddenMethodError.class, 1); setErrorsCount("", ConstraintError.class, 1); @@ -155,7 +155,7 @@ public void avoidHardcodedKeysExamples() { HeadlessCryptoScanner scanner = createScanner(mavenProject); setErrorsCount("", ConstraintError.class, 3); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", TypestateError.class, 1); @@ -183,7 +183,7 @@ public void avoidImproperKeyLenExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -193,7 +193,7 @@ public void avoidImproperKeyLenExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -231,7 +231,7 @@ public void avoidImproperKeyLenExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -241,7 +241,7 @@ public void avoidImproperKeyLenExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); scanner.exec(); @@ -257,7 +257,7 @@ public void avoidInsecureDefaultsExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ForbiddenMethodError.class, 1); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); @@ -275,7 +275,7 @@ public void avoidInsecureDefaultsExamples() { // negative test case setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", ConstraintError.class, 1); // positive test case @@ -285,7 +285,7 @@ public void avoidInsecureDefaultsExamples() { // negative test case setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", ConstraintError.class, 1); scanner.exec(); @@ -341,7 +341,7 @@ public void avoidInsecurePaddingExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -351,7 +351,7 @@ public void avoidInsecurePaddingExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -361,7 +361,7 @@ public void avoidInsecurePaddingExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -371,7 +371,7 @@ public void avoidInsecurePaddingExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -381,7 +381,7 @@ public void avoidInsecurePaddingExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -391,7 +391,7 @@ public void avoidInsecurePaddingExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); scanner.exec(); @@ -449,7 +449,7 @@ public void avoidInsecureSymEncExamples() { setErrorsCount("", TypestateError.class, 1); setErrorsCount("", TypestateError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 5); + setErrorsCount("", RequiredPredicateError.class, 6); scanner.exec(); assertErrors(); @@ -464,14 +464,14 @@ public void avoidKeyReuseInStreamsExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); scanner.exec(); @@ -689,7 +689,7 @@ public void doNotPrintSecretsExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", TypestateError.class, 1); @@ -716,7 +716,7 @@ public void encryptThenHashOrMACExamples() { setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); setErrorsCount("", TypestateError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); scanner.exec(); assertErrors(); @@ -762,7 +762,7 @@ public void secureConfigsRSAExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -772,7 +772,7 @@ public void secureConfigsRSAExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -789,10 +789,12 @@ public void secureConfigsRSAExamples() { setErrorsCount("", TypestateError.class, 1); // positive test case + setErrorsCount("", ConstraintError.class, 0); setErrorsCount("", RequiredPredicateError.class, 0); setErrorsCount("", TypestateError.class, 1); // negative test case + setErrorsCount("", ConstraintError.class, 0); setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); @@ -806,7 +808,7 @@ public void secureConfigsRSAExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -816,7 +818,7 @@ public void secureConfigsRSAExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -826,7 +828,7 @@ public void secureConfigsRSAExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -836,7 +838,7 @@ public void secureConfigsRSAExamples() { // negative test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); scanner.exec(); @@ -925,7 +927,7 @@ public void secureStreamCipherExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", TypestateError.class, 2); scanner.exec(); diff --git a/CryptoAnalysis/src/test/java/tests/headless/BragaCryptoMisusesTest.java b/CryptoAnalysis/src/test/java/tests/headless/BragaCryptoMisusesTest.java index 234ba7aa2..a123dd98a 100644 --- a/CryptoAnalysis/src/test/java/tests/headless/BragaCryptoMisusesTest.java +++ b/CryptoAnalysis/src/test/java/tests/headless/BragaCryptoMisusesTest.java @@ -141,17 +141,17 @@ public void constantKeyExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ConstraintError.class, 2); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", RequiredPredicateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); scanner.exec(); @@ -166,11 +166,12 @@ public void constPwd4PBEExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ConstraintError.class, 2); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ForbiddenMethodError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 2); + + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ConstraintError.class, 2); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ForbiddenMethodError.class, 1); @@ -187,7 +188,7 @@ public void customCryptoExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ConstraintError.class, 2); setErrorsCount("", TypestateError.class, 1); @@ -265,7 +266,7 @@ public void fixedSeedExamples() { HeadlessCryptoScanner scanner = createScanner(mavenProject); setErrorsCount("", TypestateError.class, 4); - setErrorsCount("", RequiredPredicateError.class, 7); + setErrorsCount("", RequiredPredicateError.class, 10); setErrorsCount("", ConstraintError.class, 2); setErrorsCount("", IncompleteOperationError.class, 6); setErrorsCount("", RequiredPredicateError.class, 2); @@ -337,13 +338,13 @@ public void insecureComboMacEncExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", TypestateError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", TypestateError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", TypestateError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", TypestateError.class, 2); scanner.exec(); @@ -406,19 +407,19 @@ public void insecureDefaultExamples() { setErrorsCount("", ConstraintError.class, 1); setErrorsCount("", ForbiddenMethodError.class, 1); setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); // positive test case setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // negative test case setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", TypestateError.class, 1); // positive test case @@ -558,9 +559,9 @@ public void insecureStreamCipherExamples() { HeadlessCryptoScanner scanner = createScanner(mavenProject); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 5); + setErrorsCount("", RequiredPredicateError.class, 7); setErrorsCount("", IncompleteOperationError.class, 3); - setErrorsCount("", RequiredPredicateError.class, 4); + setErrorsCount("", RequiredPredicateError.class, 5); setErrorsCount("", TypestateError.class, 2); scanner.exec(); @@ -613,15 +614,15 @@ public void keyReuseInStreamCipherExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 5); + setErrorsCount("", RequiredPredicateError.class, 7); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 5); + setErrorsCount("", RequiredPredicateError.class, 7); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 5); + setErrorsCount("", RequiredPredicateError.class, 7); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 6); + setErrorsCount("", RequiredPredicateError.class, 8); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", TypestateError.class, 1); scanner.exec(); @@ -637,7 +638,7 @@ public void nonceReuseExamples() { HeadlessCryptoScanner scanner = createScanner(mavenProject); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); scanner.exec(); assertErrors(); @@ -663,15 +664,15 @@ public void paramsPBEExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ConstraintError.class, 1); setErrorsCount("", ForbiddenMethodError.class, 1); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ConstraintError.class, 1); setErrorsCount("", ForbiddenMethodError.class, 1); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 2); + setErrorsCount("", RequiredPredicateError.class, 3); setErrorsCount("", ConstraintError.class, 1); setErrorsCount("", ForbiddenMethodError.class, 1); setErrorsCount("", TypestateError.class, 1); @@ -762,19 +763,19 @@ public void riskyInsecureCryptoExamples() { setErrorsCount("", ForbiddenMethodError.class, 1); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", ConstraintError.class, 2); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); setErrorsCount("", TypestateError.class, 5); setErrorsCount("", ConstraintError.class, 5); - setErrorsCount("", RequiredPredicateError.class, 4); + setErrorsCount("", RequiredPredicateError.class, 8); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); scanner.exec(); assertErrors(); @@ -808,7 +809,7 @@ public void staticCounterCTRExamples() { MavenProject mavenProject = createAndCompile(mavenProjectPath); HeadlessCryptoScanner scanner = createScanner(mavenProject); - setErrorsCount("", RequiredPredicateError.class, 5); + setErrorsCount("", RequiredPredicateError.class, 6); setErrorsCount("", TypestateError.class, 2); scanner.exec(); @@ -843,7 +844,7 @@ public void undefinedCSPExamples() { setErrorsCount("", ConstraintError.class, 1); setErrorsCount("", TypestateError.class, 1); setErrorsCount("", TypestateError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); setErrorsCount("", ConstraintError.class, 2); setErrorsCount("", ConstraintError.class, 1); setErrorsCount("", RequiredPredicateError.class, 2); @@ -864,82 +865,82 @@ public void weakConfigsRSAExamples() { // positive test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); // negative test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); // positive test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); // negative test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); // positive test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); // negative test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); // positive test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); // negative test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); // positive test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); // negative test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); // positive test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); // negative test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); // positive test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); // negative test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); // positive test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 1); - setErrorsCount("", RequiredPredicateError.class, 1); + setErrorsCount("", RequiredPredicateError.class, 2); // negative test case setErrorsCount("", TypestateError.class, 1); setErrorsCount("", ConstraintError.class, 2); - setErrorsCount("", RequiredPredicateError.class, 3); + setErrorsCount("", RequiredPredicateError.class, 4); // positive test case setErrorsCount("", TypestateError.class, 1); diff --git a/CryptoAnalysis/src/test/java/tests/pattern/IssuesTest.java b/CryptoAnalysis/src/test/java/tests/pattern/IssuesTest.java new file mode 100644 index 000000000..1dcfe13fd --- /dev/null +++ b/CryptoAnalysis/src/test/java/tests/pattern/IssuesTest.java @@ -0,0 +1,40 @@ +package tests.pattern; + +import java.security.GeneralSecurityException; +import java.security.KeyFactory; +import java.security.PublicKey; +import java.security.spec.X509EncodedKeySpec; + +import org.junit.Test; + +import crypto.analysis.CrySLRulesetSelector.Ruleset; +import test.UsagePatternTestingFramework; +import test.assertions.Assertions; + +public class IssuesTest extends UsagePatternTestingFramework { + + @Override + protected Ruleset getRuleSet() { + return Ruleset.JavaCryptographicArchitecture; + } + + @Test + public void testIssue421() throws GeneralSecurityException { + // Related to issue 421: https://github.com/CROSSINGTUD/CryptoAnalysis/issues/421 + X509EncodedKeySpec keySpec1 = new X509EncodedKeySpec("insecureKeyBytes".getBytes()); + X509EncodedKeySpec keySpec2 = new X509EncodedKeySpec("insecureKeyBytes".getBytes()); + + Assertions.notHasEnsuredPredicate(keySpec1); + Assertions.notHasEnsuredPredicate(keySpec2); + + KeyFactory kf = KeyFactory.getInstance("RSA"); + PublicKey pubkey1 = kf.generatePublic(keySpec1); + Assertions.notHasEnsuredPredicate(pubkey1); + + PublicKey pubkey2 = kf.generatePublic(keySpec2); + Assertions.notHasEnsuredPredicate(pubkey2); + + Assertions.predicateErrors(4); + } + +}