Pull request for 10 rules ESS-ENN

rules/c/security/sizeof-this-c.yml

@@ -0,0 +1,13 @@
+id: sizeof-this-c
+language: c
+severity: warning
+message: >-
+ Do not use `sizeof(this)` to get the number of bytes of the object in
+ memory. It returns the size of the pointer, not the size of the object.
+note: >-
+ [CWE-467]: Use of sizeof() on a Pointer Type
+ [REFERENCES]
+ - https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array
+rule:
+ any:
+ - pattern: "sizeof(this)"

rules/html/security/plaintext-http-link-html.yml

@@ -0,0 +1,15 @@
+id: plaintext-http-link-html
+language: html
+severity: info
+message: >-
+ This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL
+ if possible.
+note: >-
+ [CWE-319] Authentication Bypass by Primary Weakness
+ [REFERENCES]
+ - https://cwe.mitre.org/data/definitions/319.html
+rule:
+ pattern: <a $$$ href=$URL>$C</a>
+constraints:
+ URL:
+ regex: ^['"`]?([Hh][Tt][Tt][Pp]://)

rules/java/security/cbc-padding-oracle-java.yml

@@ -0,0 +1,17 @@
+id: cbc-padding-oracle-java
+severity: warning
+language: java
+message: >-
+ Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A
+ malicious actor could discern the difference between plaintext with valid
+ or invalid padding. Further, CBC mode does not include any integrity
+ checks. Use 'AES/GCM/NoPadding' instead.
+note: >-
+ [CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
+ [REFERENCES]
+ - https://capec.mitre.org/data/definitions/463.html
+rule:
+ pattern: Cipher.getInstance($MODE)
+constraints:
+ MODE:
+ regex: '.*/CBC/PKCS5Padding'

rules/java/security/desede-is-deprecated-java.yml

@@ -0,0 +1,16 @@
+id: desede-is-deprecated-java
+language: java
+severity: warning
+message: >-
+ Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.
+note: >-
+ [CWE-326]: Inadequate Encryption Strength
+ [OWASP A03:2017]: Sensitive Data Exposure
+ [OWASP A02:2021]: Cryptographic Failures
+ [REFERENCES]
+ - https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE
+ - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
+rule:
+ any:
+ - pattern: $CIPHER.getInstance("=~/DESede.*/")
+ - pattern: $CRYPTO.KeyGenerator.getInstance("DES")

rules/java/security/no-null-cipher-java.yml

@@ -0,0 +1,17 @@
+id: no-null-cipher-java
+severity: warning
+language: java
+message: >-
+ NullCipher was detected. This will not encrypt anything; the cipher
+ text will be the same as the plain text. Use a valid, secure cipher:
+ Cipher.getInstance("AES/CBC/PKCS7PADDING"). See
+ https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
+ for more information.
+note: >-
+ [CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
+ [REFERENCES]
+ - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
+rule:
+ any:
+ - pattern: new NullCipher($$$)
+ - pattern: new javax.crypto.NullCipher($$$)

rules/java/security/rsa-no-padding-java.yml

@@ -0,0 +1,14 @@
+id: rsa-no-padding-java
+severity: warning
+language: java
+message: >-
+ Using RSA without OAEP mode weakens the encryption.
+note: >-
+ [CWE-326] Inadequate Encryption Strength
+ [REFERENCES]
+ - https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/
+rule:
+ pattern: $YST.getInstance($MODE)
+constraints:
+ MODE:
+ regex: 'RSA/[Nn][Oo][Nn][Ee]/NoPadding'

rules/kotlin/security/desede-is-deprecated-kotlin.yml

@@ -0,0 +1,16 @@
+id: desede-is-deprecated-kotlin
+language: kotlin
+severity: warning
+message: >-
+ Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.
+note: >-
+ [CWE-326]: Inadequate Encryption Strength
+ [OWASP A03:2017]: Sensitive Data Exposure
+ [OWASP A02:2021]: Cryptographic Failures
+ [REFERENCES]
+ - https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE
+ - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
+rule:
+ any:
+ - pattern: $CIPHER.getInstance("=~/DESede.*/")
+ - pattern: $CRYPTO.KeyGenerator.getInstance("DES")

rules/scala/security/rsa-padding-set-scala.yml

@@ -0,0 +1,15 @@
+id: rsa-padding-set-scala
+language: scala
+severity: warning
+message: >-
+ Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may.
+note: >-
+ [CWE-780] Use of RSA Algorithm without OAEP
+ [REFERENCES]
+ - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
+rule:
+ any:
+ - pattern: $CIPHER.getInstance($MODE)
+constraints:
+ MODE:
+ regex: '.*RSA/.*/NoPadding.*'

rules/scala/security/xmlinputfactory-dtd-enabled-scala.yml

@@ -0,0 +1,25 @@
+id: xmlinputfactory-dtd-enabled-scala
+language: scala
+severity: warning
+message: >-
+ XMLInputFactory being instantiated without calling the setProperty
+ functions that are generally used for disabling entity processing. User
+ controlled data in XML Document builder can result in XML Internal Entity
+ Processing vulnerabilities like the disclosure of confidential data,
+ denial of service, Server Side Request Forgery (SSRF), port scanning. Make
+ sure to disable entity processing functionality.
+note: >-
+ [CWE-611] Improper Restriction of XML External Entity.
+ [REFERENCES]
+ - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
+rule:
+ any:
+ - pattern: XMLInputFactory.newFactory($$$)
+ - pattern: XMLInputFactory.newInstance($$$)
+ - pattern: new XMLInputFactory($$$)
+precedes: 
+ not:
+ pattern: $XMLFACTORY.setProperty($MODE, false)
+constraints:
+ MODE:
+ regex: 'javax.xml.stream.isSupportingExternalEntities'

rules/swift/security/insecure-biometrics-swift.yml

@@ -0,0 +1,18 @@
+id: insecure-biometrics-swift
+language: swift
+severity: info
+message: >-
+ The application was observed to leverage biometrics via Local
+ Authentication, which returns a simple boolean result for authentication.
+ This design is subject to bypass with runtime tampering tools such as
+ Frida, Substrate, and others. Although this is limited to rooted
+ (jailbroken) devices, consider implementing biometric authentication the
+ reliable way - via Keychain Services.
+note: >-
+ [CWE-305] Authentication Bypass by Primary Weakness
+ [REFERENCES]
+ - https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication
+ - https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df
+rule:
+ pattern: |
+ $X.evaluatePolicy

tests/__snapshots__/cbc-padding-oracle-java-snapshot.yml

@@ -0,0 +1,8 @@
+id: cbc-padding-oracle-java
+snapshots:
+ Cipher.getInstance("AES/CBC/PKCS5Padding");:
+ labels:
+ - source: Cipher.getInstance("AES/CBC/PKCS5Padding")
+ style: primary
+ start: 0
+ end: 42

tests/__snapshots__/desede-is-deprecated-java-snapshot.yml

@@ -0,0 +1,10 @@
+id: desede-is-deprecated-java
+snapshots:
+ ? |
+ Cipher.getInstance("DESede/ECB/PKCS5Padding");
+ javax.crypto.KeyGenerator.getInstance("DES")
+ : labels:
+ - source: javax.crypto.KeyGenerator.getInstance("DES")
+ style: primary
+ start: 47
+ end: 91

tests/__snapshots__/desede-is-deprecated-kotlin-snapshot.yml

@@ -0,0 +1,10 @@
+id: desede-is-deprecated-kotlin
+snapshots:
+ ? |
+ Cipher.getInstance("DESede/ECB/PKCS5Padding");
+ javax.crypto.KeyGenerator.getInstance("DES")
+ : labels:
+ - source: javax.crypto.KeyGenerator.getInstance("DES")
+ style: primary
+ start: 47
+ end: 91

tests/__snapshots__/insecure-biometrics-swift-snapshot.yml

@@ -0,0 +1,9 @@
+id: insecure-biometrics-swift
+snapshots:
+ ? |
+ context.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: "Authenticate to the application"
+ : labels:
+ - source: context.evaluatePolicy
+ style: primary
+ start: 0
+ end: 22

tests/__snapshots__/no-null-cipher-java-snapshot.yml

@@ -0,0 +1,10 @@
+id: no-null-cipher-java
+snapshots:
+ ? |-
+ Cipher doNothingCihper = new NullCipher();
+ new javax.crypto.NullCipher();
+ : labels:
+ - source: new NullCipher()
+ style: primary
+ start: 25
+ end: 41

tests/__snapshots__/plaintext-http-link-html-snapshot.yml

@@ -0,0 +1,15 @@
+id: plaintext-http-link-html
+snapshots:
+ ? |
+ <a href="http://astgrep.dev">Astgrep</a>
+ <a href='http://astgrep.dev'>Astgrep</a>
+ <a href=http://astgrep.dev>Astgrep</a>
+ <a class="foo" href="http://astgrep.dev">Astgrep</a>
+ <a class='foo' href='http://astgrep.dev'>Astgrep</a>
+ <a class=foo href=http://astgrep.dev>Astgrep</a>
+ <a href="HTTP://ASTGREP.DEV">Astgrep</a>
+ : labels:
+ - source: <a href="http://astgrep.dev">Astgrep</a>
+ style: primary
+ start: 0
+ end: 40

tests/__snapshots__/rsa-no-padding-java-snapshot.yml

@@ -0,0 +1,10 @@
+id: rsa-no-padding-java
+snapshots:
+ ? |-
+ Cipher.getInstance("RSA/None/NoPadding");
+ Cipher.getInstance("RSA/NONE/NoPadding");
+ : labels:
+ - source: Cipher.getInstance("RSA/None/NoPadding")
+ style: primary
+ start: 0
+ end: 40

tests/__snapshots__/rsa-padding-set-scala-snapshot.yml

@@ -0,0 +1,8 @@
+id: rsa-padding-set-scala
+snapshots:
+ Cipher.getInstance("RSA/ECB/NoPadding"):
+ labels:
+ - source: Cipher.getInstance("RSA/ECB/NoPadding")
+ style: primary
+ start: 0
+ end: 39

tests/__snapshots__/sizeof-this-c-snapshot.yml

@@ -0,0 +1,9 @@
+id: sizeof-this-c
+snapshots:
+ ? |
+ return sizeof(this);
+ : labels:
+ - source: sizeof(this)
+ style: primary
+ start: 7
+ end: 19

tests/__snapshots__/xmlinputfactory-dtd-enabled-scala-snapshot.yml

@@ -0,0 +1,11 @@
+id: xmlinputfactory-dtd-enabled-scala
+snapshots:
+ ? |-
+ val factory = XMLInputFactory.newFactory()
+ val fileReader = new FileReader(file)
+ val fileReader = new FileReader(file)
+ : labels:
+ - source: XMLInputFactory.newFactory()
+ style: primary
+ start: 14
+ end: 42

tests/c/sizeof-this-c-test.yml

@@ -0,0 +1,7 @@
+id: sizeof-this-c
+valid:
+ - |
+ return sizeof(*this);
+invalid:
+ - |
+ return sizeof(this);

tests/html/plaintext-http-link-html-test.yml

@@ -0,0 +1,15 @@
+id: plaintext-http-link-html
+valid:
+ - |
+ <a href="https://astgrep.dev">Astgrep</a>
+ <a href="https://astgrep.dev/http://">Astgrep</a>
+ <a href="javascript:alert(1)">Astgrep</a>
+invalid:
+ - |
+ <a href="http://astgrep.dev">Astgrep</a>
+ <a href='http://astgrep.dev'>Astgrep</a>
+ <a href=http://astgrep.dev>Astgrep</a>
+ <a class="foo" href="http://astgrep.dev">Astgrep</a>
+ <a class='foo' href='http://astgrep.dev'>Astgrep</a>
+ <a class=foo href=http://astgrep.dev>Astgrep</a>
+ <a href="HTTP://ASTGREP.DEV">Astgrep</a>

tests/java/cbc-padding-oracle-java-test.yml

@@ -0,0 +1,7 @@
+id: cbc-padding-oracle-java
+valid:
+ - |
+ Cipher.getInstance("AES/GCM/NoPadding");
+invalid:
+ - |
+ Cipher.getInstance("AES/CBC/PKCS5Padding");

tests/java/desede-is-deprecated-java-test.yml

@@ -0,0 +1,8 @@
+id: desede-is-deprecated-java
+valid:
+ - |
+ Cipher.getInstance("AES/GCM/NoPadding");
+invalid:
+ - |
+ Cipher.getInstance("DESede/ECB/PKCS5Padding");
+ javax.crypto.KeyGenerator.getInstance("DES")

tests/java/no-null-cipher-java-test.yml

@@ -0,0 +1,8 @@
+id: no-null-cipher-java
+valid:
+ - |
+ Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+invalid:
+ - |
+ Cipher doNothingCihper = new NullCipher();
+ new javax.crypto.NullCipher();

tests/java/rsa-no-padding-java-test.yml

@@ -0,0 +1,8 @@
+id: rsa-no-padding-java
+valid:
+ - |
+ Cipher.getInstance("RSA/ECB/OAEPWithMD5AndMGF1Padding");
+invalid:
+ - |
+ Cipher.getInstance("RSA/None/NoPadding");
+ Cipher.getInstance("RSA/NONE/NoPadding");

tests/kotlin/desede-is-deprecated-kotlin-test.yml

@@ -0,0 +1,8 @@
+id: desede-is-deprecated-kotlin
+valid:
+ - |
+ Cipher.getInstance("AES/GCM/NoPadding");
+invalid:
+ - |
+ Cipher.getInstance("DESede/ECB/PKCS5Padding");
+ javax.crypto.KeyGenerator.getInstance("DES")