Skip to content

Commit 2f84d25

Browse files
owen-mcowen-mc
committed
Java: Inline expectation should have space after $
This was a regex-find-replace from `// \$(?! )` (using a negative lookahead) to `// $ `.
1 parent a2f45f1 commit 2f84d25

File tree

89 files changed

+2792
-2746
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+2792
-2746
lines changed

‎java/ql/src/Security/CWE/CWE-295/ImproperWebViewCertificateValidation.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
class Bad extends WebViewClient {
22
// BAD: All certificates are trusted.
3-
public void onReceivedSslError (WebView view, SslErrorHandler handler, SslError error) { // $hasResult
4-
handler.proceed();
3+
public void onReceivedSslError (WebView view, SslErrorHandler handler, SslError error) { // $ hasResult
4+
handler.proceed();
55
}
66
}
77

88
class Good extends WebViewClient {
99
PublicKey myPubKey = ...;
1010

1111
// GOOD: Only certificates signed by a certain public key are trusted.
12-
public void onReceivedSslError (WebView view, SslErrorHandler handler, SslError error) { // $hasResult
12+
public void onReceivedSslError (WebView view, SslErrorHandler handler, SslError error) { // $ hasResult
1313
try {
1414
X509Certificate cert = error.getCertificate().getX509Certificate();
1515
cert.verify(this.myPubKey);
@@ -18,5 +18,5 @@ public void onReceivedSslError (WebView view, SslErrorHandler handler, SslError
1818
catch (CertificateException|NoSuchAlgorithmException|InvalidKeyException|NoSuchProviderException|SignatureException e) {
1919
handler.cancel();
2020
}
21-
}
22-
}
21+
}
22+
}

‎java/ql/test/experimental/query-tests/quantum/examples/BadMacUse/BadMacUse.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,20 +47,20 @@ public void BadDecryptThenMacOnPlaintextVerify(byte[] encryptionKeyBytes, byte[]
4747
SecretKey encryptionKey = new SecretKeySpec(encryptionKeyBytes, "AES");
4848
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
4949
cipher.init(Cipher.DECRYPT_MODE, encryptionKey, new SecureRandom());
50-
byte[] plaintext = cipher.doFinal(ciphertext); // $Source
50+
byte[] plaintext = cipher.doFinal(ciphertext); // $ Source
5151

5252
// Now verify MAC (too late)
5353
SecretKey macKey = new SecretKeySpec(macKeyBytes, "HmacSHA256");
5454
Mac mac = Mac.getInstance("HmacSHA256");
5555
mac.init(macKey);
56-
byte[] computedMac = mac.doFinal(plaintext); // $Alert[java/quantum/examples/bad-mac-order-decrypt-to-mac]
56+
byte[] computedMac = mac.doFinal(plaintext); // $ Alert[java/quantum/examples/bad-mac-order-decrypt-to-mac]
5757

5858
if (!MessageDigest.isEqual(receivedMac, computedMac)) {
5959
throw new SecurityException("MAC verification failed");
6060
}
6161
}
6262

63-
public void BadMacOnPlaintext(byte[] encryptionKeyBytes, byte[] macKeyBytes, byte[] plaintext) throws Exception {// $Source
63+
public void BadMacOnPlaintext(byte[] encryptionKeyBytes, byte[] macKeyBytes, byte[] plaintext) throws Exception {// $ Source
6464
// Create keys directly from provided byte arrays
6565
SecretKey encryptionKey = new SecretKeySpec(encryptionKeyBytes, "AES");
6666
SecretKey macKey = new SecretKeySpec(macKeyBytes, "HmacSHA256");
@@ -73,7 +73,7 @@ public void BadMacOnPlaintext(byte[] encryptionKeyBytes, byte[] macKeyBytes, byt
7373
// Encrypt the plaintext
7474
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
7575
cipher.init(Cipher.ENCRYPT_MODE, encryptionKey, new SecureRandom());
76-
byte[] ciphertext = cipher.doFinal(plaintext); // $Alert[java/quantum/examples/bad-mac-order-encrypt-plaintext-also-in-mac]
76+
byte[] ciphertext = cipher.doFinal(plaintext); // $ Alert[java/quantum/examples/bad-mac-order-encrypt-plaintext-also-in-mac]
7777

7878
// Concatenate ciphertext and MAC
7979
byte[] output = new byte[ciphertext.length + computedMac.length];
@@ -132,7 +132,7 @@ public byte[] falsePositiveDecryptToMac(byte[] encryptionKeyBytes, byte[] macKey
132132

133133

134134
/**
135-
* Correct inputs to a decrypt and MAC operation, but the ordering is unsafe.
135+
* Correct inputs to a decrypt and MAC operation, but the ordering is unsafe.
136136
* The function decrypts THEN computes the MAC on the plaintext.
137137
* It should have the MAC computed on the ciphertext first.
138138
*/
@@ -143,13 +143,13 @@ public void decryptThenMac(byte[] encryptionKeyBytes, byte[] macKeyBytes, byte[]
143143
byte[] receivedMac = Arrays.copyOfRange(input, input.length - macLength, input.length);
144144

145145
// Decrypt first (unsafe)
146-
byte[] plaintext = decryptUsingWrapper(ciphertext, encryptionKeyBytes, new byte[16]); // $Source
146+
byte[] plaintext = decryptUsingWrapper(ciphertext, encryptionKeyBytes, new byte[16]); // $ Source
147147

148148
// Now verify MAC (too late)
149149
SecretKey macKey = new SecretKeySpec(macKeyBytes, "HmacSHA256");
150150
Mac mac = Mac.getInstance("HmacSHA256");
151151
mac.init(macKey);
152-
byte[] computedMac = mac.doFinal(ciphertext); // $Alert[java/quantum/examples/bad-mac-order-decrypt-then-mac], False positive for Plaintext reuse
152+
byte[] computedMac = mac.doFinal(ciphertext); // $ Alert[java/quantum/examples/bad-mac-order-decrypt-then-mac], False positive for Plaintext reuse
153153

154154
if (!MessageDigest.isEqual(receivedMac, computedMac)) {
155155
throw new SecurityException("MAC verification failed");

‎java/ql/test/experimental/query-tests/quantum/examples/InsecureOrUnknownNonceSource/InsecureIVorNonceSource.java‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -11,33 +11,33 @@ public class InsecureIVorNonceSource {
1111

1212
// BAD: AES-GCM with static IV from a byte array
1313
public byte[] encryptWithStaticIvByteArrayWithInitializer(byte[] key, byte[] plaintext) throws Exception {
14-
byte[] iv = new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }; // $Source
14+
byte[] iv = new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }; // $ Source
1515

1616
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
1717
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
1818

1919
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
20-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]
20+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $ Alert[java/quantum/examples/insecure-iv-or-nonce]
2121
cipher.update(plaintext);
2222
return cipher.doFinal();
2323
}
2424

2525
// BAD: AES-GCM with static IV from zero-initialized byte array
2626
public byte[] encryptWithZeroStaticIvByteArray(byte[] key, byte[] plaintext) throws Exception {
27-
byte[] iv = new byte[16];
27+
byte[] iv = new byte[16];
2828

2929
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
3030
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
3131

3232
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
33-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/unknown-iv-or-nonce-source]
33+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $ Alert[java/quantum/examples/unknown-iv-or-nonce-source]
3434
cipher.update(plaintext);
3535
return cipher.doFinal();
3636
}
3737

3838
// BAD: AES-CBC with static IV from 1-initialized byte array
3939
public byte[] encryptWithStaticIvByteArray(byte[] key, byte[] plaintext) throws Exception {
40-
byte[] iv = new byte[16];
40+
byte[] iv = new byte[16];
4141
for (byte i = 0; i < iv.length; i++) {
4242
iv[i] = 1;
4343
}
@@ -46,55 +46,55 @@ public byte[] encryptWithStaticIvByteArray(byte[] key, byte[] plaintext) throws
4646
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
4747

4848
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
49-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]
49+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $ Alert[java/quantum/examples/insecure-iv-or-nonce]
5050
cipher.update(plaintext);
5151
return cipher.doFinal();
5252
}
5353

5454
// BAD: AES-GCM with static IV from a multidimensional byte array
5555
public byte[] encryptWithOneOfStaticIvs01(byte[] key, byte[] plaintext) throws Exception {
5656
byte[][] staticIvs = new byte[][] {
57-
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }, // $Source
58-
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 } // $Source
59-
};
57+
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }, // $ Source
58+
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 } // $ Source
59+
};
6060

6161
GCMParameterSpec ivSpec = new GCMParameterSpec(128, staticIvs[1]);
6262
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
6363

6464
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
65-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]
65+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $ Alert[java/quantum/examples/insecure-iv-or-nonce]
6666
cipher.update(plaintext);
6767
return cipher.doFinal();
6868
}
6969

7070
// BAD: AES-GCM with static IV from a multidimensional byte array
7171
public byte[] encryptWithOneOfStaticIvs02(byte[] key, byte[] plaintext) throws Exception {
7272
byte[][] staticIvs = new byte[][] {
73-
new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }, // $Source
74-
new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 } // $Source
75-
};
73+
new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }, // $ Source
74+
new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 } // $ Source
75+
};
7676

7777
GCMParameterSpec ivSpec = new GCMParameterSpec(128, staticIvs[1]);
7878
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
7979

8080
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
81-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]
81+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $ Alert[java/quantum/examples/insecure-iv-or-nonce]
8282
cipher.update(plaintext);
8383
return cipher.doFinal();
8484
}
8585

8686
// BAD: AES-GCM with static IV from a zero-initialized multidimensional byte array
8787
public byte[] encryptWithOneOfStaticZeroIvs(byte[] key, byte[] plaintext) throws Exception {
8888
byte[][] ivs = new byte[][] {
89-
new byte[8],
90-
new byte[16]
89+
new byte[8],
90+
new byte[16]
9191
};
9292

9393
GCMParameterSpec ivSpec = new GCMParameterSpec(128, ivs[1]);
9494
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
9595

9696
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
97-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/unknown-iv-or-nonce-source]
97+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $ Alert[java/quantum/examples/unknown-iv-or-nonce-source]
9898
cipher.update(plaintext);
9999
return cipher.doFinal();
100100
}
@@ -166,8 +166,8 @@ public byte[] encryptWithRandomIvWithArraysCopy(byte[] key, byte[] plaintext) th
166166
return cipher.doFinal();
167167
}
168168

169-
public byte[] generate(int size) throws Exception {
170-
if (size == 0) {
169+
public byte[] generate(int size) throws Exception {
170+
if (size == 0) {
171171
return new byte[0];
172172
}
173173
byte[] randomBytes = new byte[size];
@@ -183,15 +183,15 @@ public byte[] encryptWithGeneratedIvByteArray(byte[] key, byte[] plaintext) thro
183183
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
184184

185185
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
186-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
186+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
187187
cipher.update(plaintext);
188188
return cipher.doFinal();
189189
}
190190

191191
public byte[] generateInsecureRandomBytes(int numBytes) {
192192
Random random = new Random();
193193
byte[] bytes = new byte[numBytes];
194-
random.nextBytes(bytes); // $Source
194+
random.nextBytes(bytes); // $ Source
195195
return bytes;
196196
}
197197

@@ -203,7 +203,7 @@ public byte[] encryptWithGeneratedIvByteArrayInsecure(byte[] key, byte[] plainte
203203
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
204204

205205
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
206-
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/examples/insecure-iv-or-nonce]]
206+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $ Alert[java/quantum/examples/insecure-iv-or-nonce]]
207207
cipher.update(plaintext);
208208
return cipher.doFinal();
209209
}

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownAsymmetricKeySize/InsufficientAsymmetricKeySize.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
public class InsufficientAsymmetricKeySize{
33
public static void test() throws Exception{
44
KeyPairGenerator keyPairGen1 = KeyPairGenerator.getInstance("RSA");
5-
keyPairGen1.initialize(1024); // $Alert[java/quantum/examples/weak-asymmetric-key-gen-size]
5+
keyPairGen1.initialize(1024); // $ Alert[java/quantum/examples/weak-asymmetric-key-gen-size]
66
keyPairGen1.generateKeyPair();
77

88
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("DSA");
9-
keyPairGen2.initialize(1024); // $Alert[java/quantum/examples/weak-asymmetric-key-gen-size]
9+
keyPairGen2.initialize(1024); // $ Alert[java/quantum/examples/weak-asymmetric-key-gen-size]
1010
keyPairGen2.generateKeyPair();
1111

1212
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("DH");
13-
keyPairGen3.initialize(1024); // $Alert[java/quantum/examples/weak-asymmetric-key-gen-size]
13+
keyPairGen3.initialize(1024); // $ Alert[java/quantum/examples/weak-asymmetric-key-gen-size]
1414
keyPairGen3.generateKeyPair();
1515

1616
KeyPairGenerator keyPairGen4 = KeyPairGenerator.getInstance("RSA");
@@ -25,4 +25,4 @@ public static void test() throws Exception{
2525
keyPairGen6.initialize(2048); // GOOD
2626
keyPairGen6.generateKeyPair();
2727
}
28-
}
28+
}

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownBlockMode/Test.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,25 +10,25 @@ public static void main(String[] args) throws Exception {
1010
byte[] data = "SensitiveData".getBytes();
1111

1212
// Insecure block mode: ECB
13-
Cipher cipherECB = Cipher.getInstance("AES/ECB/PKCS5Padding"); // $Alert
13+
Cipher cipherECB = Cipher.getInstance("AES/ECB/PKCS5Padding"); // $ Alert
1414
cipherECB.init(Cipher.ENCRYPT_MODE, key);
1515
byte[] ecbEncrypted = cipherECB.doFinal(data);
1616
System.out.println("ECB encrypted: " + bytesToHex(ecbEncrypted));
1717

1818
// Insecure block mode: CFB
19-
Cipher cipherCFB = Cipher.getInstance("AES/CFB/PKCS5Padding"); // $Alert
19+
Cipher cipherCFB = Cipher.getInstance("AES/CFB/PKCS5Padding"); // $ Alert
2020
cipherCFB.init(Cipher.ENCRYPT_MODE, key, iv);
2121
byte[] cfbEncrypted = cipherCFB.doFinal(data);
2222
System.out.println("CFB encrypted: " + bytesToHex(cfbEncrypted));
2323

2424
// Insecure block mode: OFB
25-
Cipher cipherOFB = Cipher.getInstance("AES/OFB/PKCS5Padding"); // $Alert
25+
Cipher cipherOFB = Cipher.getInstance("AES/OFB/PKCS5Padding"); // $ Alert
2626
cipherOFB.init(Cipher.ENCRYPT_MODE, key, iv);
2727
byte[] ofbEncrypted = cipherOFB.doFinal(data);
2828
System.out.println("OFB encrypted: " + bytesToHex(ofbEncrypted));
2929

3030
// Insecure block mode: CTR
31-
Cipher cipherCTR = Cipher.getInstance("AES/CTR/NoPadding"); // $Alert
31+
Cipher cipherCTR = Cipher.getInstance("AES/CTR/NoPadding"); // $ Alert
3232
cipherCTR.init(Cipher.ENCRYPT_MODE, key, iv);
3333
byte[] ctrEncrypted = cipherCTR.doFinal(data);
3434
System.out.println("CTR encrypted: " + bytesToHex(ctrEncrypted));
@@ -54,4 +54,4 @@ private static String bytesToHex(byte[] bytes) {
5454
sb.append(String.format("%02x", b));
5555
return sb.toString();
5656
}
57-
}
57+
}

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownHash/WeakHashing.java‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,33 +12,33 @@ void hashing() throws NoSuchAlgorithmException, IOException {
1212
props.load(new FileInputStream("example.properties"));
1313

1414
// BAD: Using a weak hashing algorithm even with a secure default
15-
MessageDigest bad = MessageDigest.getInstance(props.getProperty("hashAlg1")); // $Alert[java/quantum/examples/weak-hash]
15+
MessageDigest bad = MessageDigest.getInstance(props.getProperty("hashAlg1")); // $ Alert[java/quantum/examples/weak-hash]
1616

1717
// BAD: Using a weak hashing algorithm even with a secure default
18-
MessageDigest bad2 = MessageDigest.getInstance(props.getProperty("hashAlg1", "SHA-256")); // $Alert[java/quantum/examples/weak-hash]
18+
MessageDigest bad2 = MessageDigest.getInstance(props.getProperty("hashAlg1", "SHA-256")); // $ Alert[java/quantum/examples/weak-hash]
1919

2020
// BAD: Using a strong hashing algorithm but with a weak default
21-
MessageDigest bad3 = MessageDigest.getInstance(props.getProperty("hashAlg2", "MD5")); // $Alert[java/quantum/examples/weak-hash]
21+
MessageDigest bad3 = MessageDigest.getInstance(props.getProperty("hashAlg2", "MD5")); // $ Alert[java/quantum/examples/weak-hash]
2222

2323
// BAD: Using a weak hash
24-
MessageDigest bad4 = MessageDigest.getInstance("SHA-1"); // $Alert[java/quantum/examples/weak-hash]
24+
MessageDigest bad4 = MessageDigest.getInstance("SHA-1"); // $ Alert[java/quantum/examples/weak-hash]
2525

2626
// BAD: Property does not exist and default (used value) is unknown
27-
MessageDigest bad5 = MessageDigest.getInstance(props.getProperty("non-existent_property", "non-existent_default")); // $Alert[java/quantum/examples/unknown-hash]
27+
MessageDigest bad5 = MessageDigest.getInstance(props.getProperty("non-existent_property", "non-existent_default")); // $ Alert[java/quantum/examples/unknown-hash]
2828

2929
java.util.Properties props2 = new java.util.Properties();
3030

3131
props2.load(new FileInputStream("unobserved-file.properties"));
3232

33-
// BAD: "hashAlg2" is not visible in the file loaded for props2, should be an unknown
33+
// BAD: "hashAlg2" is not visible in the file loaded for props2, should be an unknown
3434
// FALSE NEGATIVE for unknown hash
35-
MessageDigest bad6 = MessageDigest.getInstance(props2.getProperty("hashAlg2", "SHA-256")); // $Alert[java/quantum/examples/unknown-hash]
35+
MessageDigest bad6 = MessageDigest.getInstance(props2.getProperty("hashAlg2", "SHA-256")); // $ Alert[java/quantum/examples/unknown-hash]
3636

3737
// GOOD: Using a strong hashing algorithm
3838
MessageDigest ok = MessageDigest.getInstance(props.getProperty("hashAlg2"));
3939

4040
// BAD?: Property does not exist (considered unknown) and but default is secure
41-
MessageDigest ok2 = MessageDigest.getInstance(props.getProperty("non-existent-property", "SHA-256")); // $Alert[java/quantum/examples/unknown-hash]
41+
MessageDigest ok2 = MessageDigest.getInstance(props.getProperty("non-existent-property", "SHA-256")); // $ Alert[java/quantum/examples/unknown-hash]
4242

4343
// GOOD: Using a strong hashing algorithm
4444
MessageDigest ok3 = MessageDigest.getInstance("SHA3-512");

0 commit comments

Comments
 (0)