Add gcm parameter spec and tag related crypto assets

engine/src/main/java/com/ibm/engine/model/InitializationVectorSize.java

@@ -0,0 +1,29 @@
+/*
+ * SonarQube Cryptography Plugin
+ * Copyright (C) 2025 IBM
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.ibm.engine.model;
+
+import javax.annotation.Nonnull;
+
+public class InitializationVectorSize<T> extends Size<T> {
+    public InitializationVectorSize(
+            @Nonnull Integer value, @Nonnull UnitType unitType, @Nonnull T location) {
+        super(value, unitType, location);
+    }
+}

engine/src/main/java/com/ibm/engine/model/TagSize.java

@@ -0,0 +1,28 @@
+/*
+ * SonarQube Cryptography Plugin
+ * Copyright (C) 2025 IBM
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.ibm.engine.model;
+
+import javax.annotation.Nonnull;
+
+public class TagSize<T> extends Size<T> {
+    public TagSize(@Nonnull Integer value, @Nonnull UnitType unitType, @Nonnull T location) {
+        super(value, unitType, location);
+    }
+}

engine/src/main/java/com/ibm/engine/model/factory/InitializationVectorSizeFactory.java

@@ -0,0 +1,46 @@
+/*
+ * SonarQube Cryptography Plugin
+ * Copyright (C) 2025 IBM
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.ibm.engine.model.factory;
+
+import com.ibm.engine.detection.ResolvedValue;
+import com.ibm.engine.model.IValue;
+import com.ibm.engine.model.InitializationVectorSize;
+import com.ibm.engine.model.Size;
+import java.util.Optional;
+import javax.annotation.Nonnull;
+
+public class InitializationVectorSizeFactory<T> extends SizeFactory<T> implements IValueFactory<T> {
+
+    public InitializationVectorSizeFactory() {
+        super();
+    }
+
+    public InitializationVectorSizeFactory(@Nonnull Size.UnitType interpretAsUnitType) {
+        super(interpretAsUnitType);
+    }
+
+    @Nonnull
+    @Override
+    public Optional<IValue<T>> apply(@Nonnull ResolvedValue<Object, T> objectTResolvedValue) {
+        return super.apply(
+                objectTResolvedValue,
+                (value, tree) -> new InitializationVectorSize<>(value, Size.UnitType.BIT, tree));
+    }
+}

engine/src/main/java/com/ibm/engine/model/factory/SizeFactory.java

@@ -54,8 +54,4 @@ protected Optional<IValue<T>> apply(
                             .map(value -> createSize.apply(value, objectTResolvedValue.tree()));
         };
     }
-
-    //     private Size<T> createSize(int value, T tree) {
-    //         return new Size<>(value, Size.UnitType.BIT, tree);
-    //     }
 }

engine/src/main/java/com/ibm/engine/model/factory/TagSizeFactory.java

@@ -0,0 +1,45 @@
+/*
+ * SonarQube Cryptography Plugin
+ * Copyright (C) 2025 IBM
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.ibm.engine.model.factory;
+
+import com.ibm.engine.detection.ResolvedValue;
+import com.ibm.engine.model.IValue;
+import com.ibm.engine.model.Size;
+import com.ibm.engine.model.TagSize;
+import java.util.Optional;
+import javax.annotation.Nonnull;
+
+public class TagSizeFactory<T> extends SizeFactory<T> implements IValueFactory<T> {
+    public TagSizeFactory() {
+        super();
+    }
+
+    public TagSizeFactory(@Nonnull Size.UnitType interpretAsUnitType) {
+        super(interpretAsUnitType);
+    }
+
+    @Nonnull
+    @Override
+    public Optional<IValue<T>> apply(@Nonnull ResolvedValue<Object, T> objectTResolvedValue) {
+        return super.apply(
+                objectTResolvedValue,
+                (value, tree) -> new TagSize<>(value, Size.UnitType.BIT, tree));
+    }
+}

java/src/main/java/com/ibm/plugin/rules/detection/jca/algorithmspec/JcaAlgorithmParameterSpec.java

@@ -39,7 +39,8 @@ public static List<IDetectionRule<Tree>> rules() {
                         JcaPSSParameterSpec.rules().stream(),
                         JcaMGF1ParameterSpec.rules().stream(),
                         JcaDHGenParameterSpec.rules().stream(),
-                        JcaDHParameterSpec.rules().stream())
+                        JcaDHParameterSpec.rules().stream(),
+                        JcaGCMParameterSpec.rules().stream())
                 .flatMap(i -> i)
                 .toList();
     }

java/src/main/java/com/ibm/plugin/rules/detection/jca/algorithmspec/JcaECParameterSpec.java

@@ -32,6 +32,7 @@
 import javax.annotation.Nonnull;
 import org.sonar.plugins.java.api.tree.Tree;
 
+@SuppressWarnings("java:S1192")
 public final class JcaECParameterSpec {
 
     private static final IDetectionRule<Tree> EC_FIELD_P =

java/src/main/java/com/ibm/plugin/rules/detection/jca/algorithmspec/JcaGCMParameterSpec.java

@@ -0,0 +1,70 @@
+/*
+ * SonarQube Cryptography Plugin
+ * Copyright (C) 2025 IBM
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.ibm.plugin.rules.detection.jca.algorithmspec;
+
+import com.ibm.engine.model.Size;
+import com.ibm.engine.model.context.AlgorithmParameterContext;
+import com.ibm.engine.model.factory.InitializationVectorSizeFactory;
+import com.ibm.engine.model.factory.TagSizeFactory;
+import com.ibm.engine.rule.IDetectionRule;
+import com.ibm.engine.rule.builder.DetectionRuleBuilder;
+import java.util.List;
+import javax.annotation.Nonnull;
+import org.sonar.plugins.java.api.tree.Tree;
+
+public final class JcaGCMParameterSpec {
+
+    private static final IDetectionRule<Tree> GCM_PARAMETER_SPEC1 =
+            new DetectionRuleBuilder<Tree>()
+                    .createDetectionRule()
+                    .forObjectTypes("javax.crypto.spec.GCMParameterSpec")
+                    .forConstructor()
+                    .withMethodParameter("int")
+                    .shouldBeDetectedAs(new TagSizeFactory<>(Size.UnitType.BIT))
+                    .withMethodParameter("byte[]")
+                    .shouldBeDetectedAs(new InitializationVectorSizeFactory<>(Size.UnitType.BYTE))
+                    .buildForContext(new AlgorithmParameterContext())
+                    .inBundle(() -> "Jca")
+                    .withoutDependingDetectionRules();
+
+    private static final IDetectionRule<Tree> GCM_PARAMETER_SPEC2 =
+            new DetectionRuleBuilder<Tree>()
+                    .createDetectionRule()
+                    .forObjectTypes("javax.crypto.spec.GCMParameterSpec")
+                    .forConstructor()
+                    .withMethodParameter("int")
+                    .shouldBeDetectedAs(new TagSizeFactory<>(Size.UnitType.BIT))
+                    .withMethodParameter("byte[]")
+                    .withMethodParameter("int")
+                    .withMethodParameter("int")
+                    .shouldBeDetectedAs(new InitializationVectorSizeFactory<>(Size.UnitType.BYTE))
+                    .buildForContext(new AlgorithmParameterContext())
+                    .inBundle(() -> "Jca")
+                    .withoutDependingDetectionRules();
+
+    private JcaGCMParameterSpec() {
+        // nothing
+    }
+
+    @Nonnull
+    public static List<IDetectionRule<Tree>> rules() {
+        return List.of(GCM_PARAMETER_SPEC1, GCM_PARAMETER_SPEC2);
+    }
+}

java/src/main/java/com/ibm/plugin/translation/JavaTranslationProcess.java

@@ -27,7 +27,6 @@
 import com.ibm.mapper.reorganizer.Reorganizer;
 import com.ibm.mapper.utils.Utils;
 import com.ibm.plugin.translation.translator.JavaTranslator;
-import java.util.Collections;
 import java.util.List;
 import javax.annotation.Nonnull;
 import org.sonar.plugins.java.api.JavaCheck;
@@ -62,6 +61,6 @@ public List<INode> initiate(
         final List<INode> enrichedValues = Enricher.enrich(reorganizedValues).stream().toList();
         Utils.printNodeTree("enriched   ", enrichedValues);
 
-        return Collections.unmodifiableCollection(enrichedValues).stream().toList();
+        return enrichedValues.stream().toList();
     }
 }

java/src/main/java/com/ibm/plugin/translation/translator/contexts/JavaAlgorithmParameterContextTranslator.java

@@ -23,6 +23,7 @@
 import com.ibm.engine.model.IValue;
 import com.ibm.engine.model.KeySize;
 import com.ibm.engine.model.MacSize;
+import com.ibm.engine.model.TagSize;
 import com.ibm.engine.model.context.IDetectionContext;
 import com.ibm.mapper.mapper.jca.JcaAlgorithmMapper;
 import com.ibm.mapper.model.INode;
@@ -65,6 +66,9 @@ protected Optional<INode> translateBC(
         } else if (value instanceof MacSize<Tree> macSize) {
             TagLength tagLength = new TagLength(macSize.getValue(), detectionLocation);
             return Optional.of(tagLength);
+        } else if (value instanceof TagSize<Tree> tagSize) {
+            TagLength tagLength = new TagLength(tagSize.getValue(), detectionLocation);
+            return Optional.of(tagLength);
         }
         return Optional.empty();
     }

java/src/test/files/rules/detection/jca/algorithmspec/JcaGCMParameterSpecTestFile.java

@@ -0,0 +1,35 @@
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.KeySpec;
+import java.util.Base64;
+
+import javax.crypto.BadPaddingException;
+import javax.crypto.Cipher;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.NoSuchPaddingException;
+import javax.crypto.SecretKey;
+import javax.crypto.SecretKeyFactory;
+import javax.crypto.spec.GCMParameterSpec;
+import javax.crypto.spec.PBEKeySpec;
+import javax.crypto.spec.SecretKeySpec;
+
+public class JcaGCMParameterSpecTestFile {
+
+    public void test() {
+        String password = "password";
+        String salt = "salt";
+
+        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256"); // Noncompliant {{(SecretKey) PBKDF2}}
+        KeySpec spec = new PBEKeySpec(password.toCharArray(), salt.getBytes(), 65536, 256);
+        SecretKey secret = new SecretKeySpec(factory.generateSecret(spec).getEncoded(), "AES"); // Noncompliant {{(SecretKey) AES}}
+
+        String nonce = "nonce";
+
+        GCMParameterSpec gcmSpec = new GCMParameterSpec(128, Base64.getDecoder().decode(nonce));
+        Cipher cipher = Cipher.getInstance("AES"); // Noncompliant {{(BlockCipher) AES128}}
+        cipher.init(Cipher.DECRYPT_MODE, secret, gcmSpec);
+    }
+}

java/src/test/java/com/ibm/plugin/rules/detection/jca/algorithmspec/JcaGCMParameterSpecTest.java

@@ -0,0 +1,50 @@
+/*
+ * SonarQube Cryptography Plugin
+ * Copyright (C) 2025 IBM
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.ibm.plugin.rules.detection.jca.algorithmspec;
+
+import com.ibm.engine.detection.DetectionStore;
+import com.ibm.mapper.model.INode;
+import com.ibm.plugin.TestBase;
+import java.util.List;
+import javax.annotation.Nonnull;
+import org.junit.jupiter.api.Test;
+import org.sonar.java.checks.verifier.CheckVerifier;
+import org.sonar.plugins.java.api.JavaCheck;
+import org.sonar.plugins.java.api.JavaFileScannerContext;
+import org.sonar.plugins.java.api.semantic.Symbol;
+import org.sonar.plugins.java.api.tree.Tree;
+
+class JcaGCMParameterSpecTest extends TestBase {
+
+    @Test
+    void test() {
+        CheckVerifier.newVerifier()
+                .onFile(
+                        "src/test/files/rules/detection/jca/algorithmspec/JcaGCMParameterSpecTestFile.java")
+                .withChecks(this)
+                .verifyIssues();
+    }
+
+    @Override
+    public void asserts(
+            int findingId,
+            @Nonnull DetectionStore<JavaCheck, Tree, Symbol, JavaFileScannerContext> detectionStore,
+            @Nonnull List<INode> nodes) {}
+}