use-of-weak-rsa-key-java

rules/java/security/use-of-weak-rsa-key-java.yml

@@ -0,0 +1,16 @@
+id: use-of-weak-rsa-key-java
+language: java
+severity: warning
+message: >-
+ RSA keys should be at least 2048 bits based on NIST recommendation.
+note: >-
+ [CWE-326] Inadequate Encryption Strength.
+ [REFERENCES]
+ - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
+rule:
+ pattern: |
+ $KEY.initialize($AST)
+follows: KeyPairGenerator $KEY = $G.getInstance("RSA");
+constraints:
+ AST:
+ regex: '^(-?(0|[1-9][0-9]?|[1-9][0-9]{2}|1[0-9]{3}|20[0-3][0-9]|204[0-7])(\.[0-9]+)?|0|-[1-9][0-9]*|-[1-9][0-9]{2,}|-1[0-9]{3}|-20[0-3][0-9]|-204[0-7])$'

tests/__snapshots__/use-of-weak-rsa-key-java-snapshot.yml

@@ -0,0 +1,34 @@
+id: use-of-weak-rsa-key-java
+snapshots:
+ ? |
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(-512);
+ : labels:
+ - source: keyGen.initialize(-512)
+ style: primary
+ start: 63
+ end: 86
+ ? |
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(512);
+ : labels:
+ - source: keyGen.initialize(512)
+ style: primary
+ start: 63
+ end: 85
+ ? |
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(512.0);
+ : labels:
+ - source: keyGen.initialize(512.0)
+ style: primary
+ start: 63
+ end: 87
+ ? |
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(512.09);
+ : labels:
+ - source: keyGen.initialize(512.09)
+ style: primary
+ start: 63
+ end: 88

tests/java/use-of-weak-rsa-key-java-test.yml

@@ -0,0 +1,18 @@
+id: use-of-weak-rsa-key-java
+valid:
+ - |
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(2048);
+invalid:
+ - |
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(512);
+ - |
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(-512);
+ - |
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(512.09);
+ - |
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(512.0);