René's URL Explorer Experiment


Title: Java: Static initialization vector by artem-smotrakov · Pull Request #6357 · github/codeql · GitHub

Open Graph Title: Java: Static initialization vector by artem-smotrakov · Pull Request #6357 · github/codeql

X Title: Java: Static initialization vector by artem-smotrakov · Pull Request #6357 · github/codeql

Description: When a cipher is used in certain modes, it needs an initialization vector (IV). IVs are used to randomize the encryption, therefore they should be unique and ideally unpredictable. Otherwise, the same plaintexts result in same ciphertexts under a given secret key. If a static IV is used for encryption, this lets an attacker learn if the same data pieces are transfered or stored, or this can help the attacker run a dictionary attack. I'd like to add a query detecting static IVs: The query looks for data flows from static byte array initialization to Cipher.init() calls. Only ciphers initialized for encryption are flagged. The query focuses only static initialization vectors. Therefore it skips cases when the IV is modified. For that reason, the query ignores cases when the IV is filled out by Random instead of SecureRandom. At first, the query used to be much simpler. Then, I tested it on ~1000 open source projects which uncovered several FPs. Fixing those FPs made the query a bit more complex. The query finds the following vulnerabilities: CVE-2020-5408 in Spring Security. Please note that the issues has not been patched. They only deprecated the vulnerable methods. Therefore, the query detects the issue on the latest version of Spring Security. OFBIZ-12281 in Apache OFBiz PDFBOX-4191 in Apache PDFBox

Open Graph Description: When a cipher is used in certain modes, it needs an initialization vector (IV). IVs are used to randomize the encryption, therefore they should be unique and ideally unpredictable. Otherwise, the s...

X Description: When a cipher is used in certain modes, it needs an initialization vector (IV). IVs are used to randomize the encryption, therefore they should be unique and ideally unpredictable. Otherwise, the s...

Opengraph URL: https://github.com/github/codeql/pull/6357

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:1b8ff2ff-864b-3151-c034-c7da9619fd45
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idA094:30AD7C:253E23A:347886B:6A4CE2A0
html-safe-nonce2ac7cc1a150992122bf8db084224741efdcacda870c333ddebe161b5d9b05a3a
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBMDk0OjMwQUQ3QzoyNTNFMjNBOjM0Nzg4NkI6NkE0Q0UyQTAiLCJ2aXNpdG9yX2lkIjoiNDM1NTMzMjg1Njk3MDI3MzQ0MSIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9
visitor-hmac410bc8a6cf6352730d0d581ae83b5ee3750bc5377d7e62f94e4ea4424d0ca23c
hovercard-subject-tagpull_request:695708487
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql/pull/6357/files
twitter:imagehttps://avatars.githubusercontent.com/u/19523081?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/19523081?s=400&v=4
og:image:altWhen a cipher is used in certain modes, it needs an initialization vector (IV). IVs are used to randomize the encryption, therefore they should be unique and ideally unpredictable. Otherwise, the s...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None299b43bca6e02ad35197ffeba30d2466846d5fb02ab96fbced5b5e6cec589fb8
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql git https://github.com/github/codeql.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id143040428
octolytics-dimension-repository_nwogithub/codeql
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id143040428
octolytics-dimension-repository_network_root_nwogithub/codeql
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
releasec5a57f04eeb310f57c73fd6d751d957e2ca27ed2
ui-targetcanary-2
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql/pull/6357/files#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F6357%2Ffiles
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F6357%2Ffiles
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql
Reloadhttps://github.com/github/codeql/pull/6357/files
Reloadhttps://github.com/github/codeql/pull/6357/files
Reloadhttps://github.com/github/codeql/pull/6357/files
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
github https://github.com/github
codeqlhttps://github.com/github/codeql
Notifications https://github.com/login?return_to=%2Fgithub%2Fcodeql
Fork 2k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Star 9.8k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Code https://github.com/github/codeql
Issues 987 https://github.com/github/codeql/issues
Pull requests 424 https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality 0 https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Code https://github.com/github/codeql
Issues https://github.com/github/codeql/issues
Pull requests https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
smowtonhttps://github.com/smowton
github:mainhttps://github.com/github/codeql/tree/main
artem-smotrakov:static-ivhttps://github.com/artem-smotrakov/ql/tree/static-iv
Conversation 39 https://github.com/github/codeql/pull/6357
Findings https://github.com/github/codeql/pull/6357/findings
Commits 14 https://github.com/github/codeql/pull/6357/commits
Checks 0 https://github.com/github/codeql/pull/6357/checks
Files changed https://github.com/github/codeql/pull/6357/files
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
Java: Static initialization vector https://github.com/github/codeql/pull/6357/files#top
Show all changes 14 commits https://github.com/github/codeql/pull/6357/files
218731c Added a query for static initialization vectors in encryption artem-smotrakov Jul 11, 2021 https://github.com/github/codeql/pull/6357/commits/218731ca0aca5c3810bcfd42c9df6655104bc0e3
cfe74b5 Use inline-expectation tests for StaticInitializationVector.ql artem-smotrakov Jul 16, 2021 https://github.com/github/codeql/pull/6357/commits/cfe74b527a9bdbaf9c79e461fe62f3a7b9a5b115
df0f9ee Fixed a few typos artem-smotrakov Aug 8, 2021 https://github.com/github/codeql/pull/6357/commits/df0f9ee3a552e283eb5538f3cc82cf618d9bdb30
4e69081 Support multi-dimensional arrays artem-smotrakov Aug 13, 2021 https://github.com/github/codeql/pull/6357/commits/4e69081c220a053940ab5ca3c3b67047faee6595
1199240 Be precise when checking for Cipher.ENCRYPT_MODE artem-smotrakov Aug 14, 2021 https://github.com/github/codeql/pull/6357/commits/11992404ec3bb368a4e3455d260532819a8defd4
d218813 Updated qldoc for ArrayUpdate artem-smotrakov Aug 14, 2021 https://github.com/github/codeql/pull/6357/commits/d218813320dd26113a9fee6f5c20aaec64d011bc
e2dc975 Covered copyOfRange() and clone() in ArrayUpdate artem-smotrakov Aug 14, 2021 https://github.com/github/codeql/pull/6357/commits/e2dc9753ac767b9110e33ea2d7d241a572410e71
fbac589 Fixed a typo in qldoc artem-smotrakov Aug 14, 2021 https://github.com/github/codeql/pull/6357/commits/fbac5891b874d1fa411f1e4e3a1f056529b9b241
c80a1da Don't consider copyOf() and clone() in ArrayUpdate artem-smotrakov Aug 25, 2021 https://github.com/github/codeql/pull/6357/commits/c80a1da48366d54471da7a7d1a7fcfbe327c478e
86b7b2b Updated qldoc for ArrayUpdate artem-smotrakov Aug 25, 2021 https://github.com/github/codeql/pull/6357/commits/86b7b2b86dccd4517e32b94e19c44c361073c513
f97c8bb Removed sanitizer in StaticInitializationVectorConfig artem-smotrakov Aug 25, 2021 https://github.com/github/codeql/pull/6357/commits/f97c8bb049fb4607da97bf632997dbfef9b08269
f41828e Better qldoc in StaticInitializationVectorQuery.qll artem-smotrakov Aug 25, 2021 https://github.com/github/codeql/pull/6357/commits/f41828e5dbf8ae99fd33bc20ceee94e23ee321fb
23e2322 Simplify ArrayUpdate artem-smotrakov Aug 25, 2021 https://github.com/github/codeql/pull/6357/commits/23e23226358bf5276ee6d9f8d6e6f0e570155bea
1dd4bf0 Simplify StaticInitializationVectorSource artem-smotrakov Aug 26, 2021 https://github.com/github/codeql/pull/6357/commits/1dd4bf00acf99deee3b2d9d7ca92eb80f7476a05
Clear filters https://github.com/github/codeql/pull/6357/files
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
BadStaticInitializationVector.java https://github.com/github/codeql/pull/6357/files#diff-c7f22617337fd3db033452aba416e44307692bc216a4f8b089b83961bc3dfdc5
GoodRandomInitializationVector.java https://github.com/github/codeql/pull/6357/files#diff-481d7a7c5bf253ae7913e11a4ba0fc2fd61315931befabefb80526eee6a1e19f
StaticInitializationVector.qhelp https://github.com/github/codeql/pull/6357/files#diff-c9c480f96001be4fb9871d69a5abea896c61599ae5e677b5905260a735a2aa15
StaticInitializationVector.ql https://github.com/github/codeql/pull/6357/files#diff-c76c3370cebece4812e97e39548c0fc57233616928742c889b9b684de863f579
StaticInitializationVectorQuery.qll https://github.com/github/codeql/pull/6357/files#diff-28f259a17a193008489f4e74b8d0df3e4ef491206b5aa0f8a9ac27685957b6cc
StaticInitializationVector.java https://github.com/github/codeql/pull/6357/files#diff-cf76ba3e0d3f3d98abf49650061a3c54fff518c6895c8c8509aff8bec529624a
StaticInitializationVectorTest.expected https://github.com/github/codeql/pull/6357/files#diff-d0f1ec570c374318d37b6b0ddb0f03fe322c4b171ac3165bc2160f9876f2a110
StaticInitializationVectorTest.ql https://github.com/github/codeql/pull/6357/files#diff-d6e2844fc00b2e74a2475ce68b06a604c2c68af238da6ca7c27498cf245d1b7d
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-1204/BadStaticInitializationVector.javahttps://github.com/github/codeql/pull/6357/files#diff-c7f22617337fd3db033452aba416e44307692bc216a4f8b089b83961bc3dfdc5
View file https://github.com/artem-smotrakov/ql/blob/1dd4bf00acf99deee3b2d9d7ca92eb80f7476a05/java/ql/src/experimental/Security/CWE/CWE-1204/BadStaticInitializationVector.java
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6357/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-1204/GoodRandomInitializationVector.javahttps://github.com/github/codeql/pull/6357/files#diff-481d7a7c5bf253ae7913e11a4ba0fc2fd61315931befabefb80526eee6a1e19f
View file https://github.com/artem-smotrakov/ql/blob/1dd4bf00acf99deee3b2d9d7ca92eb80f7476a05/java/ql/src/experimental/Security/CWE/CWE-1204/GoodRandomInitializationVector.java
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6357/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-1204/StaticInitializationVector.qhelphttps://github.com/github/codeql/pull/6357/files#diff-c9c480f96001be4fb9871d69a5abea896c61599ae5e677b5905260a735a2aa15
View file https://github.com/artem-smotrakov/ql/blob/1dd4bf00acf99deee3b2d9d7ca92eb80f7476a05/java/ql/src/experimental/Security/CWE/CWE-1204/StaticInitializationVector.qhelp
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6357/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-1204/StaticInitializationVector.qlhttps://github.com/github/codeql/pull/6357/files#diff-c76c3370cebece4812e97e39548c0fc57233616928742c889b9b684de863f579
View file https://github.com/artem-smotrakov/ql/blob/1dd4bf00acf99deee3b2d9d7ca92eb80f7476a05/java/ql/src/experimental/Security/CWE/CWE-1204/StaticInitializationVector.ql
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6357/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/semmle/code/java/security/StaticInitializationVectorQuery.qllhttps://github.com/github/codeql/pull/6357/files#diff-28f259a17a193008489f4e74b8d0df3e4ef491206b5aa0f8a9ac27685957b6cc
View file https://github.com/artem-smotrakov/ql/blob/1dd4bf00acf99deee3b2d9d7ca92eb80f7476a05/java/ql/src/experimental/semmle/code/java/security/StaticInitializationVectorQuery.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6357/{{ revealButtonHref }}
Marcono1234https://github.com/Marcono1234
Jul 25, 2021https://github.com/github/codeql/pull/6357/files#r676153503
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
getComponentType()https://codeql.github.com/codeql-standard-libraries/java/semmle/code/java/Type.qll/predicate.Type$Array$getComponentType.0.html
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
artem-smotrakovhttps://github.com/artem-smotrakov
Aug 8, 2021https://github.com/github/codeql/pull/6357/files#r684756226
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
sayshttps://codeql.github.com/codeql-standard-libraries/java/semmle/code/java/Type.qll/predicate.Type$Array$getElementType.0.html
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
Marcono1234https://github.com/Marcono1234
Aug 8, 2021https://github.com/github/codeql/pull/6357/files#r684807122
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
smowtonhttps://github.com/smowton
Aug 10, 2021https://github.com/github/codeql/pull/6357/files#r685773927
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
artem-smotrakovhttps://github.com/artem-smotrakov
Aug 13, 2021https://github.com/github/codeql/pull/6357/files#r688717982
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
Marcono1234https://github.com/Marcono1234
Aug 13, 2021https://github.com/github/codeql/pull/6357/files#r688740282
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
artem-smotrakovhttps://github.com/artem-smotrakov
Aug 13, 2021https://github.com/github/codeql/pull/6357/files#r688754549
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
@smowtonhttps://github.com/smowton
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
smowtonhttps://github.com/smowton
Aug 16, 2021https://github.com/github/codeql/pull/6357/files#r689391675
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
artem-smotrakovhttps://github.com/artem-smotrakov
Aug 25, 2021https://github.com/github/codeql/pull/6357/files#r695932661
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
#6552 (comment)https://github.com/github/codeql/issues/6552#issue-979422575
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
Please reload this pagehttps://github.com/github/codeql/pull/6357/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.