Skip to main content

Find cryptographic vulnerability chains

io.moderne.cryptography.FindCryptoVulnerabilitiesPipeline

Detects cryptographic vulnerabilities that span multiple operations, tracking flow from hardcoded algorithms through key material to encryption operations.

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Example​

Before​
import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.SecretKeySpec;

public class SimpleCrypto {
    public byte[] encrypt(byte[] data, byte[] keyBytes) throws Exception {
        // Hardcoded algorithm flows through the entire pipeline
        SecretKeySpec keySpec = new SecretKeySpec(keyBytes, "AES");
        SecretKeyFactory factory = SecretKeyFactory.getInstance("AES");
        SecretKey key = factory.generateSecret(keySpec);
        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, key);
        return cipher.doFinal(data);
    }
}
After​
import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.SecretKeySpec;

public class SimpleCrypto {
    public byte[] encrypt(byte[] data, byte[] keyBytes) throws Exception {
        // Hardcoded algorithm flows through the entire pipeline
        SecretKeySpec keySpec = new SecretKeySpec(keyBytes, /*~~(ALGORITHM source)~~>*/"AES");
        SecretKeyFactory factory = SecretKeyFactory.getInstance("AES");
        SecretKey key = factory.generateSecret(keySpec);
        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, key);
        return /*~~(ALGORITHM use)~~>*/cipher.doFinal(data);
    }
}

Usage​

This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI.

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe FindCryptoVulnerabilitiesPipeline

If the recipe is not available locally, then you can install it using:

mod config recipes jar install io.moderne.recipe:rewrite-cryptography:0.13.5

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Taint flow data​

org.openrewrite.analysis.java.taint.TaintFlowDataTable

Tracks taint flow through pipeline stages, supporting up to 10 stages.

Column NameDescription
Source fileThe source file where the taint flow was detected
Stage 1 NameName of the first stage in the pipeline
Stage 1 LocationCode location for the first stage
Stage 2 NameName of the second stage in the pipeline
Stage 2 LocationCode location for the second stage
Stage 3 NameName of the third stage in the pipeline
Stage 3 LocationCode location for the third stage
Stage 4 NameName of the fourth stage in the pipeline
Stage 4 LocationCode location for the fourth stage
Stage 5 NameName of the fifth stage in the pipeline
Stage 5 LocationCode location for the fifth stage
Stage 6 NameName of the sixth stage in the pipeline
Stage 6 LocationCode location for the sixth stage
Stage 7 NameName of the seventh stage in the pipeline
Stage 7 LocationCode location for the seventh stage
Stage 8 NameName of the eighth stage in the pipeline
Stage 8 LocationCode location for the eighth stage
Stage 9 NameName of the ninth stage in the pipeline
Stage 9 LocationCode location for the ninth stage
Stage 10 NameName of the tenth stage in the pipeline
Stage 10 LocationCode location for the tenth stage