Skip to content

Commit 24d7149

Browse files
karim-ouerghemmi-sonarsourcekarim-ouerghemmi-sonarsource
authored
SONARPHP-975 Additional Non-compliant Cipher Algorithms for S5547 (#734)
1 parent cd52ff9 commit 24d7149

File tree

2 files changed

+95
-18
lines changed

2 files changed

+95
-18
lines changed

Diff for: ‎php-checks/src/main/java/org/sonar/php/checks/security/RobustCipherAlgorithmCheck.java

+27-2
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,37 @@ public void visitFunctionCall(FunctionCallTree tree) {
4141
"mcrypt_rc4")));
4242

4343
checkArgument(tree, "openssl_encrypt", new ArgumentVerifier(1, "method", ImmutableSet.of(
44+
"bf-cbc",
45+
"bf-cfb",
4446
"bf-ecb",
47+
"bf-ofb",
48+
"des-cbc",
49+
"des-cfb",
50+
"des-cfb1",
51+
"des-cfb8",
52+
"des-ecb",
53+
"des-ede",
4554
"des-ede3",
55+
"des-ede3-cbc",
56+
"des-ede3-cfb",
57+
"des-ede3-cfb1",
58+
"des-ede3-cfb8",
59+
"des-ede3-ofb",
60+
"des-ede-cbc",
61+
"des-ede-cfb",
62+
"des-ede-ofb",
4663
"des-ofb",
64+
"desx-cbc",
65+
"rc2-40-cbc",
66+
"rc2-64-cbc",
4767
"rc2-cbc",
48-
"rc4"
49-
)));
68+
"rc2-cfb",
69+
"rc2-ecb",
70+
"rc2-ofb",
71+
"rc4",
72+
"rc4-40",
73+
"rc4-hmac-md5"
74+
)));
5075

5176
super.visitFunctionCall(tree);
5277
}

Diff for: ‎php-checks/src/test/resources/checks/security/RobustCipherAlgorithmCheck.php

+68-16
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,74 @@
11
<?php
2-
// mcrypt_encrypt is deprecated since PHP 7.1
3-
// mcrypt_encrypt was removed in PHP 7.2, so there's no need to test PHP named arguments on it
4-
$c1 = mcrypt_encrypt(MCRYPT_DES, $key, $plaintext, $mode); // Noncompliant
5-
$c2 = mcrypt_encrypt(MCRYPT_DES_COMPAT, $key, $plaintext, $mode); // Noncompliant
6-
$c3 = mcrypt_encrypt(MCRYPT_TRIPLEDES, $key, $plaintext, $mode); // Noncompliant
7-
8-
$c4 = mcrypt_encrypt(MCRYPT_3DES, $key, $plaintext, $mode); // Noncompliant
9-
$c5 = mcrypt_encrypt(MCRYPT_BLOWFISH, $key, $plaintext, $mode); // Noncompliant
10-
$c6 = mcrypt_encrypt(MCRYPT_RC2, $key, $plaintext, $mode); // Noncompliant
2+
$ciphertext = mcrypt_encrypt(MCRYPT_DES, $key, $plaintext, $mode); // Noncompliant
3+
$ciphertext = mcrypt_encrypt(MCRYPT_DES_COMPAT, $key, $plaintext, $mode); // Noncompliant
4+
$ciphertext = mcrypt_encrypt(MCRYPT_TRIPLEDES, $key, $plaintext, $mode); // Noncompliant
5+
$ciphertext = mcrypt_encrypt(MCRYPT_3DES, $key, $plaintext, $mode); // Noncompliant
6+
$ciphertext = mcrypt_encrypt(MCRYPT_BLOWFISH, $key, $plaintext, $mode); // Noncompliant
7+
$ciphertext = mcrypt_encrypt(MCRYPT_RC2, $key, $plaintext, $mode); // Noncompliant
118
$mcrypt_rc4 = MCRYPT_RC4;
129
$c7 = mcrypt_encrypt($mcrypt_rc4, $key, $plaintext, $mode); // Noncompliant
1310

11+
$ciphertext_raw = openssl_encrypt($plaintext, "BF-CBC", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
12+
$ciphertext_raw = openssl_encrypt($plaintext, "BF-ECB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
13+
$ciphertext_raw = openssl_encrypt($plaintext, "BF-CFB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
14+
$ciphertext_raw = openssl_encrypt($plaintext, "BF-OFB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
15+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-CBC", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
16+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-CFB1", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
17+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-CFB8", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
18+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
19+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE-CBC", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
20+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE-CFB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
21+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE-OFB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
22+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE3", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
23+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE3-CBC", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
24+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE3-CFB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
25+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE3-CFB1", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
26+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE3-CFB8", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
27+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-EDE3-OFB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
28+
$ciphertext_raw = openssl_encrypt($plaintext, "DES-OFB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
29+
$ciphertext_raw = openssl_encrypt($plaintext, "DESX-CBC", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
30+
$ciphertext_raw = openssl_encrypt($plaintext, "RC2-40-CBC", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
31+
$ciphertext_raw = openssl_encrypt($plaintext, "RC2-64-CBC", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
32+
$ciphertext_raw = openssl_encrypt($plaintext, "RC2-CBC", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
33+
$ciphertext_raw = openssl_encrypt($plaintext, "RC2-CFB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
34+
$ciphertext_raw = openssl_encrypt($plaintext, "RC2-ECB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
35+
$ciphertext_raw = openssl_encrypt($plaintext, "RC2-OFB", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
36+
$ciphertext_raw = openssl_encrypt($plaintext, "RC4", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
37+
$ciphertext_raw = openssl_encrypt($plaintext, "RC4-40", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
38+
$ciphertext_raw = openssl_encrypt($plaintext, "RC4-HMAC-MD5", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
39+
$ciphertext_raw = openssl_encrypt($plaintext, "bf-cbc", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
40+
$ciphertext_raw = openssl_encrypt($plaintext, "bf-cfb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
41+
$ciphertext_raw = openssl_encrypt($plaintext, "bf-ecb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
42+
$ciphertext_raw = openssl_encrypt($plaintext, "bf-ofb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
43+
$ciphertext_raw = openssl_encrypt($plaintext, "des-cbc", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
44+
$ciphertext_raw = openssl_encrypt($plaintext, "des-cfb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
45+
$ciphertext_raw = openssl_encrypt($plaintext, "des-cfb1", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
46+
$ciphertext_raw = openssl_encrypt($plaintext, "des-cfb8", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
47+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ecb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
48+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
49+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede-cbc", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
50+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede-cfb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
51+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede-ofb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
52+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede3", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
53+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede3-cbc", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
54+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede3-cfb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
55+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede3-cfb1", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
56+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede3-cfb8", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
57+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ede3-ofb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
58+
$ciphertext_raw = openssl_encrypt($plaintext, "des-ofb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
59+
$ciphertext_raw = openssl_encrypt($plaintext, "desx-cbc", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
60+
$ciphertext_raw = openssl_encrypt($plaintext, "rc2-40-cbc", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
61+
$ciphertext_raw = openssl_encrypt($plaintext, "rc2-64-cbc", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
62+
$ciphertext_raw = openssl_encrypt($plaintext, "rc2-cbc", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
63+
$ciphertext_raw = openssl_encrypt($plaintext, "rc2-cfb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
64+
$ciphertext_raw = openssl_encrypt($plaintext, "rc2-ecb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
65+
$ciphertext_raw = openssl_encrypt($plaintext, "rc2-ofb", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
66+
$ciphertext_raw = openssl_encrypt($plaintext, "rc4", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
67+
$ciphertext_raw = openssl_encrypt($plaintext, "rc4-40", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
68+
$ciphertext_raw = openssl_encrypt($plaintext, "rc4-hmac-md5", $key, $options=OPENSSL_RAW_DATA, $iv); // Noncompliant
1469

15-
$c8 = openssl_encrypt($plaintext, "bf-ecb", $key, OPENSSL_RAW_DATA, $iv); // Noncompliant
16-
$c9 = openssl_encrypt($plaintext, "des-ede3", $key, OPENSSL_RAW_DATA, $iv); // Noncompliant
17-
$c10 = openssl_encrypt($plaintext, "des-ofb", $key, OPENSSL_RAW_DATA, $iv); // Noncompliant
18-
$c11 = openssl_encrypt($plaintext, "rc2-cbc", $key, OPENSSL_RAW_DATA, $iv); // Noncompliant
19-
$c12 = openssl_encrypt($plaintext, "rc4", $key, OPENSSL_RAW_DATA, $iv); // Noncompliant
20-
21-
$c13 = openssl_encrypt($plaintext, "aes-256-gcm", $key, OPENSSL_RAW_DATA, $iv); // Compliant
70+
// mcrypt_encrypt is deprecated since PHP 7.1
71+
// mcrypt_encrypt was removed in PHP 7.2, so there's no need to test PHP named arguments on it
2272

2373
$c13 = openssl_encrypt($plaintext, key:$key, method:"aes-256-gcm"); // Compliant
2474
$c13 = openssl_encrypt($plaintext, key:$key, method:"rc4"); // Noncompliant
@@ -27,3 +77,5 @@ function getAlgorithm() {
2777
return "rc4";
2878
}
2979
$c13 = openssl_encrypt($plaintext, getAlgorithm(), $key, $options=OPENSSL_RAW_DATA, $iv); // Compliant - FN
80+
81+
$ciphertext_raw = openssl_encrypt($plaintext, "aes-256-gcm", $key, $options=OPENSSL_RAW_DATA, $iv); // Compliant

0 commit comments

Comments
 (0)