Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,6 @@ func main() {
prk := hkdf.Extract(sha256.New, secret, salt)

// HKDF Expand step
reader := hkdf.Expand(sha256.New, prk, info, 32) // Noncompliant {{(KeyDerivationFunction) HKDF-SHA256}}
reader := hkdf.Expand(sha256.New, prk, info, 32) // Noncompliant {{(KeyDerivationFunction) HKDF-SHA-256}}
_ = reader
}
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,6 @@ func main() {
info := []byte("info")

// HKDF Key derivation
reader := hkdf.New(sha256.New, secret, salt, info) // Noncompliant {{(KeyDerivationFunction) HKDF-SHA256}}
reader := hkdf.New(sha256.New, secret, salt, info) // Noncompliant {{(KeyDerivationFunction) HKDF-SHA-256}}
_ = reader
}
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ import (

func main() {
key := []byte("secret-key")
h := hmac.New(sha256.New, key) // Noncompliant {{(Mac) HMAC-SHA256}}
h := hmac.New(sha256.New, key) // Noncompliant {{(Mac) HMAC-SHA-256}}
h.Write([]byte("hello"))
fmt.Printf("%x\n", h.Sum(nil))
}
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ func main() {
salt := make([]byte, 16)

// PBKDF2 Key derivation using stdlib API (Go 1.24+)
key, err := pbkdf2.Key(sha256.New, "password", salt, 600000, 32) // Noncompliant {{(PasswordBasedKeyDerivationFunction) PBKDF2-SHA256}}
key, err := pbkdf2.Key(sha256.New, "password", salt, 600000, 32) // Noncompliant {{(PasswordBasedKeyDerivationFunction) PBKDF2-SHA-256}}
if err != nil {
panic(err)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,6 @@ func main() {
keyLen := 32

// PBKDF2 Key derivation
key := pbkdf2.Key(password, salt, iterations, keyLen, sha256.New) // Noncompliant {{(PasswordBasedKeyDerivationFunction) PBKDF2-SHA256}}
key := pbkdf2.Key(password, salt, iterations, keyLen, sha256.New) // Noncompliant {{(PasswordBasedKeyDerivationFunction) PBKDF2-SHA-256}}
_ = key
}
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,12 @@ import (
)

func main() {
h := sha1.New() // Noncompliant {{(MessageDigest) SHA1}}
h := sha1.New() // Noncompliant {{(MessageDigest) SHA-1}}
h.Write([]byte("hello"))
sum := h.Sum(nil)
fmt.Printf("%x\n", sum)

// Also test sha1.Sum directly
checksum := sha1.Sum([]byte("data")) // Noncompliant {{(MessageDigest) SHA1}}
checksum := sha1.Sum([]byte("data")) // Noncompliant {{(MessageDigest) SHA-1}}
fmt.Printf("%x\n", checksum)
}
Original file line number Diff line number Diff line change
Expand Up @@ -7,22 +7,22 @@ import (

func main() {
// Test sha256.New() - SHA-256
h := sha256.New() // Noncompliant {{(MessageDigest) SHA256}}
h := sha256.New() // Noncompliant {{(MessageDigest) SHA-256}}
h.Write([]byte("hello"))
sum := h.Sum(nil)
fmt.Printf("%x\n", sum)

// Test sha256.New224() - SHA-224
h224 := sha256.New224() // Noncompliant {{(MessageDigest) SHA224}}
h224 := sha256.New224() // Noncompliant {{(MessageDigest) SHA-224}}
h224.Write([]byte("hello"))
sum224 := h224.Sum(nil)
fmt.Printf("%x\n", sum224)

// Test sha256.Sum256() - SHA-256
sum256 := sha256.Sum256([]byte("data")) // Noncompliant {{(MessageDigest) SHA256}}
sum256 := sha256.Sum256([]byte("data")) // Noncompliant {{(MessageDigest) SHA-256}}
_ = sum256

// Test sha256.Sum224() - SHA-224
sum224Direct := sha256.Sum224([]byte("data")) // Noncompliant {{(MessageDigest) SHA224}}
sum224Direct := sha256.Sum224([]byte("data")) // Noncompliant {{(MessageDigest) SHA-224}}
_ = sum224Direct
}
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,15 @@ import (

func main() {
// SHA3-256 hash
h256 := sha3.New256() // Noncompliant {{(MessageDigest) SHA3-256}}
h256 := sha3.New256() // Noncompliant {{(MessageDigest) SHA-3-256}}
h256.Write([]byte("test"))
_ = h256.Sum(nil)

// SHA3-512 hash
h512 := sha3.New512() // Noncompliant {{(MessageDigest) SHA3-512}}
h512 := sha3.New512() // Noncompliant {{(MessageDigest) SHA-3-512}}
_ = h512

// Sum256 - direct hash computation
hash := sha3.Sum256([]byte("test")) // Noncompliant {{(MessageDigest) SHA3-256}}
hash := sha3.Sum256([]byte("test")) // Noncompliant {{(MessageDigest) SHA-3-256}}
_ = hash
}
Original file line number Diff line number Diff line change
Expand Up @@ -7,22 +7,22 @@ import (

func main() {
// Test sha512.New() - SHA-512
h := sha512.New() // Noncompliant {{(MessageDigest) SHA512}}
h := sha512.New() // Noncompliant {{(MessageDigest) SHA-512}}
h.Write([]byte("hello"))
sum := h.Sum(nil)
fmt.Printf("%x\n", sum)

// Test sha512.New384() - SHA-384
h384 := sha512.New384() // Noncompliant {{(MessageDigest) SHA384}}
h384 := sha512.New384() // Noncompliant {{(MessageDigest) SHA-384}}
h384.Write([]byte("hello"))
sum384 := h384.Sum(nil)
fmt.Printf("%x\n", sum384)

// Test sha512.Sum512() - SHA-512
sum512 := sha512.Sum512([]byte("data")) // Noncompliant {{(MessageDigest) SHA512}}
sum512 := sha512.Sum512([]byte("data")) // Noncompliant {{(MessageDigest) SHA-512}}
_ = sum512

// Test sha512.Sum384() - SHA-384
sum384Direct := sha512.Sum384([]byte("data")) // Noncompliant {{(MessageDigest) SHA384}}
sum384Direct := sha512.Sum384([]byte("data")) // Noncompliant {{(MessageDigest) SHA-384}}
_ = sum384Direct
}
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ public void asserts(
INode messageDigestNode = signatureNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA512");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-512");

// Digest under MessageDigest under Signature
INode digestNode = messageDigestNode.getChildren().get(Digest.class);
Expand Down Expand Up @@ -213,7 +213,7 @@ public void asserts(
INode messageDigestNode = signatureNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA512");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-512");

// Digest under MessageDigest under Signature
INode digestNode = messageDigestNode.getChildren().get(Digest.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ public void asserts(
INode messageDigestNode = signatureNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA512");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-512");

// DigestSize under MessageDigest under Signature
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand Down Expand Up @@ -195,7 +195,7 @@ public void asserts(
INode messageDigestNode = signatureNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA512");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-512");

// DigestSize under MessageDigest under Signature
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ public void asserts(
INode keyDerivationFunctionNode = nodes.get(0);
assertThat(keyDerivationFunctionNode.getKind()).isEqualTo(KeyDerivationFunction.class);
assertThat(keyDerivationFunctionNode.getChildren()).hasSize(3);
assertThat(keyDerivationFunctionNode.asString()).isEqualTo("HKDF-SHA256");
assertThat(keyDerivationFunctionNode.asString()).isEqualTo("HKDF-SHA-256");

// KeyLength under KeyDerivationFunction
INode keyLengthNode = keyDerivationFunctionNode.getChildren().get(KeyLength.class);
Expand All @@ -113,7 +113,7 @@ public void asserts(
keyDerivationFunctionNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA256");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-256");

// Digest under MessageDigest under KeyDerivationFunction
INode digestNode = messageDigestNode.getChildren().get(Digest.class);
Expand Down Expand Up @@ -162,7 +162,7 @@ public void asserts(
keyDerivationFunctionNode1.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode1).isNotNull();
assertThat(messageDigestNode1.getChildren()).hasSize(2);
assertThat(messageDigestNode1.asString()).isEqualTo("SHA256");
assertThat(messageDigestNode1.asString()).isEqualTo("SHA-256");

// Digest under MessageDigest under KeyDerivationFunction
INode digestNode1 = messageDigestNode1.getChildren().get(Digest.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -109,13 +109,13 @@ public void asserts(
INode keyDerivationFunctionNode = nodes.get(0);
assertThat(keyDerivationFunctionNode.getKind()).isEqualTo(KeyDerivationFunction.class);
assertThat(keyDerivationFunctionNode.getChildren()).hasSize(3);
assertThat(keyDerivationFunctionNode.asString()).isEqualTo("HKDF-SHA256");
assertThat(keyDerivationFunctionNode.asString()).isEqualTo("HKDF-SHA-256");

// MessageDigest under KeyDerivationFunction
INode messageDigestNode = keyDerivationFunctionNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA256");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-256");

// Digest under MessageDigest under KeyDerivationFunction
INode digestNode = messageDigestNode.getChildren().get(Digest.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ public void asserts(
INode macNode = nodes.get(0);
assertThat(macNode.getKind()).isEqualTo(Mac.class);
assertThat(macNode.getChildren()).hasSize(3);
assertThat(macNode.asString()).isEqualTo("HMAC-SHA256");
assertThat(macNode.asString()).isEqualTo("HMAC-SHA-256");

// Oid under Mac
INode oidNode = macNode.getChildren().get(Oid.class);
Expand All @@ -101,7 +101,7 @@ public void asserts(
INode messageDigestNode = macNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA256");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-256");

// Oid under MessageDigest under Mac
INode oidNode1 = messageDigestNode.getChildren().get(Oid.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ public void asserts(
INode kdfNode = nodes.get(0);
assertThat(kdfNode.getKind()).isEqualTo(PasswordBasedKeyDerivationFunction.class);
assertThat(kdfNode.getChildren()).hasSize(4);
assertThat(kdfNode.asString()).isEqualTo("PBKDF2-SHA256");
assertThat(kdfNode.asString()).isEqualTo("PBKDF2-SHA-256");

// NumberOfIterations under PBKDF2
INode iterationsNode = kdfNode.getChildren().get(NumberOfIterations.class);
Expand All @@ -145,7 +145,7 @@ public void asserts(
INode messageDigestNode = kdfNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA256");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-256");

// Digest under MessageDigest
INode digestNode = messageDigestNode.getChildren().get(Digest.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ public void asserts(
INode kdfNode = nodes.get(0);
assertThat(kdfNode.getKind()).isEqualTo(PasswordBasedKeyDerivationFunction.class);
assertThat(kdfNode.getChildren()).hasSize(4);
assertThat(kdfNode.asString()).isEqualTo("PBKDF2-SHA256");
assertThat(kdfNode.asString()).isEqualTo("PBKDF2-SHA-256");

// NumberOfIterations under PBKDF2
INode iterationsNode = kdfNode.getChildren().get(NumberOfIterations.class);
Expand All @@ -145,7 +145,7 @@ public void asserts(
INode messageDigestNode = kdfNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA256");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-256");

// Digest under MessageDigest
INode digestNode = messageDigestNode.getChildren().get(Digest.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -149,7 +149,7 @@ public void asserts(
publicKeyEncryptionNode.getChildren().get(MessageDigest.class);
assertThat(messageDigestNode).isNotNull();
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA256");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-256");

// BlockSize under MessageDigest under PublicKeyEncryption
INode blockSizeNode = messageDigestNode.getChildren().get(BlockSize.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ public void asserts(
INode messageDigestNode = nodes.get(0);
assertThat(messageDigestNode.getKind()).isEqualTo(MessageDigest.class);
assertThat(messageDigestNode.getChildren()).hasSize(4);
assertThat(messageDigestNode.asString()).isEqualTo("SHA1");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-1");

// BlockSize under MessageDigest
INode blockSizeNode = messageDigestNode.getChildren().get(BlockSize.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ public void asserts(
// MessageDigest
INode messageDigestNode = nodes.get(0);
assertThat(messageDigestNode.getKind()).isEqualTo(MessageDigest.class);
assertThat(messageDigestNode.asString()).isEqualTo("SHA256");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-256");

// DigestSize under MessageDigest
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand All @@ -101,7 +101,7 @@ public void asserts(
// MessageDigest
INode messageDigestNode = nodes.get(0);
assertThat(messageDigestNode.getKind()).isEqualTo(MessageDigest.class);
assertThat(messageDigestNode.asString()).isEqualTo("SHA224");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-224");

// DigestSize under MessageDigest
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand All @@ -127,7 +127,7 @@ public void asserts(
// MessageDigest
INode messageDigestNode = nodes.get(0);
assertThat(messageDigestNode.getKind()).isEqualTo(MessageDigest.class);
assertThat(messageDigestNode.asString()).isEqualTo("SHA256");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-256");

// DigestSize under MessageDigest
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand All @@ -153,7 +153,7 @@ public void asserts(
// MessageDigest
INode messageDigestNode = nodes.get(0);
assertThat(messageDigestNode.getKind()).isEqualTo(MessageDigest.class);
assertThat(messageDigestNode.asString()).isEqualTo("SHA224");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-224");

// DigestSize under MessageDigest
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -73,17 +73,17 @@ public void asserts(
case 0 -> {
// sha3.New256()
assertThat(value0.asString()).isEqualTo("SHA3-256");
assertThat(digestNode.asString()).isEqualTo("SHA3-256");
assertThat(digestNode.asString()).isEqualTo("SHA-3-256");
}
case 1 -> {
// sha3.New512()
assertThat(value0.asString()).isEqualTo("SHA3-512");
assertThat(digestNode.asString()).isEqualTo("SHA3-512");
assertThat(digestNode.asString()).isEqualTo("SHA-3-512");
}
case 2 -> {
// sha3.Sum256()
assertThat(value0.asString()).isEqualTo("SHA3-256");
assertThat(digestNode.asString()).isEqualTo("SHA3-256");
assertThat(digestNode.asString()).isEqualTo("SHA-3-256");
}
default -> throw new IllegalStateException("Unexpected findingId: " + findingId);
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ public void asserts(
// MessageDigest
INode messageDigestNode = nodes.get(0);
assertThat(messageDigestNode.getKind()).isEqualTo(MessageDigest.class);
assertThat(messageDigestNode.asString()).isEqualTo("SHA512");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-512");

// DigestSize under MessageDigest
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand All @@ -101,7 +101,7 @@ public void asserts(
// MessageDigest
INode messageDigestNode = nodes.get(0);
assertThat(messageDigestNode.getKind()).isEqualTo(MessageDigest.class);
assertThat(messageDigestNode.asString()).isEqualTo("SHA384");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-384");

// DigestSize under MessageDigest
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand All @@ -127,7 +127,7 @@ public void asserts(
// MessageDigest
INode messageDigestNode = nodes.get(0);
assertThat(messageDigestNode.getKind()).isEqualTo(MessageDigest.class);
assertThat(messageDigestNode.asString()).isEqualTo("SHA512");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-512");

// DigestSize under MessageDigest
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand All @@ -153,7 +153,7 @@ public void asserts(
// MessageDigest
INode messageDigestNode = nodes.get(0);
assertThat(messageDigestNode.getKind()).isEqualTo(MessageDigest.class);
assertThat(messageDigestNode.asString()).isEqualTo("SHA384");
assertThat(messageDigestNode.asString()).isEqualTo("SHA-384");

// DigestSize under MessageDigest
INode digestSizeNode = messageDigestNode.getChildren().get(DigestSize.class);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
benchmarkprops.load(
this.getClass().getClassLoader().getResourceAsStream("benchmark.properties"));
String algorithm = benchmarkprops.getProperty("hashAlg1", "SHA512");
java.security.MessageDigest md = java.security.MessageDigest.getInstance(algorithm); // Noncompliant {{(MessageDigest) SHA512}}
java.security.MessageDigest md = java.security.MessageDigest.getInstance(algorithm); // Noncompliant {{(MessageDigest) SHA-512}}
byte[] input = {(byte) '?'};
Object inputParam = param;
if (inputParam instanceof String) input = ((String) inputParam).getBytes();
Expand Down
4 changes: 2 additions & 2 deletions java/src/test/files/rules/benchmark/BenchmarkTest00009.java
Original file line number Diff line number Diff line change
Expand Up @@ -65,9 +65,9 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
try {
if (provider.length > 1) {

md = java.security.MessageDigest.getInstance("sha-384", provider[0]); // Noncompliant {{(MessageDigest) SHA384}}
md = java.security.MessageDigest.getInstance("sha-384", provider[0]); // Noncompliant {{(MessageDigest) SHA-384}}
} else {
md = java.security.MessageDigest.getInstance("sha-384", "SUN"); // Noncompliant {{(MessageDigest) SHA384}}
md = java.security.MessageDigest.getInstance("sha-384", "SUN"); // Noncompliant {{(MessageDigest) SHA-384}}
}
byte[] input = {(byte) '?'};
Object inputParam = param;
Expand Down
Loading