Skip to content

Commit f562b3d

Browse files
owen-mcowen-mc
committed
Make line differences in test comments relative
1 parent 349e8ca commit f562b3d

File tree

3 files changed

+83
-91
lines changed

3 files changed

+83
-91
lines changed

‎go/ql/test/query-tests/Security/CWE-327/CryptoAlgorithm.ql‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,23 +19,15 @@ module Test implements TestSig {
1919
exists(int c | c = count(ho.getInitialization()) |
2020
c = 0 and initialization = ""
2121
or
22-
c = 1 and
22+
c > 0 and
2323
initialization =
24-
" init from line " +
25-
strictconcat(DataFlow::Node init |
26-
init = ho.getInitialization()
24+
" init from " +
25+
strictconcat(DataFlow::Node init, int n |
26+
init = ho.getInitialization() and
27+
n = ho.getStartLine() - init.getStartLine()
2728
|
28-
init.getStartLine().toString(), ","
29-
) + "."
30-
or
31-
c > 1 and
32-
initialization =
33-
" init from lines " +
34-
strictconcat(DataFlow::Node init |
35-
init = ho.getInitialization()
36-
|
37-
init.getStartLine().toString(), ","
38-
) + "."
29+
n.toString(), ","
30+
) + " lines above."
3931
) and
4032
ho.getLocation() = location and
4133
element = ho.toString() and

‎go/ql/test/query-tests/Security/CWE-327/encryption.go‎

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -27,141 +27,141 @@ func BlockCipherDes() {
2727
// BAD, des is a weak crypto algorithm
2828
block, _ := des.NewCipher(nil)
2929

30-
block.Encrypt(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from line 28."
30+
block.Encrypt(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from 2 lines above."
3131
block.Decrypt(dst, secretByteSlice)
3232

3333
gcm1, _ := cipher.NewGCM(block)
34-
gcm1.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from line 28."
34+
gcm1.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from 6 lines above."
3535
gcm1.Open(nil, nil, secretByteSlice, nil)
3636

3737
gcm2, _ := cipher.NewGCMWithNonceSize(block, 12)
38-
gcm2.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from line 28."
38+
gcm2.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from 10 lines above."
3939
gcm2.Open(nil, nil, secretByteSlice, nil)
4040

4141
gcm3, _ := cipher.NewGCMWithRandomNonce(block)
42-
gcm3.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from line 28."
42+
gcm3.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from 14 lines above."
4343
gcm3.Open(nil, nil, secretByteSlice, nil)
4444

4545
gcm4, _ := cipher.NewGCMWithTagSize(block, 12)
46-
gcm4.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from line 28."
46+
gcm4.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. init from 18 lines above."
4747
gcm4.Open(nil, nil, secretByteSlice, nil)
4848

4949
cbcEncrypter := cipher.NewCBCEncrypter(block, nil)
50-
cbcEncrypter.CryptBlocks(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CBC. init from lines 28,49."
50+
cbcEncrypter.CryptBlocks(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CBC. init from 1,22 lines above."
5151
cipher.NewCBCDecrypter(block, nil).CryptBlocks(dst, secretByteSlice)
5252

5353
ctrStream := cipher.NewCTR(block, nil)
54-
ctrStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CTR. init from lines 28,53."
54+
ctrStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CTR. init from 1,26 lines above."
5555

56-
ctrStreamReader := &cipher.StreamReader{S: ctrStream, R: bytes.NewReader(secretByteSlice)} // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CTR. init from lines 28,53."
56+
ctrStreamReader := &cipher.StreamReader{S: ctrStream, R: bytes.NewReader(secretByteSlice)} // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CTR. init from 28,3 lines above."
5757
io.Copy(os.Stdout, ctrStreamReader)
5858

59-
ctrStreamWriter := &cipher.StreamWriter{S: ctrStream, W: os.Stdout} // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CTR. init from lines 28,53."
60-
io.Copy(ctrStreamWriter, bytes.NewReader(secretByteSlice)) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CTR. init from lines 28,53."
59+
ctrStreamWriter := &cipher.StreamWriter{S: ctrStream, W: os.Stdout} // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CTR. init from 31,6 lines above."
60+
io.Copy(ctrStreamWriter, bytes.NewReader(secretByteSlice)) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CTR. init from 32,7 lines above."
6161

6262
// deprecated
6363

6464
cfbStream := cipher.NewCFBEncrypter(block, nil)
65-
cfbStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CFB. init from lines 28,64."
65+
cfbStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: CFB. init from 1,37 lines above."
6666
cipher.NewCFBDecrypter(block, nil).XORKeyStream(dst, secretByteSlice)
6767

6868
ofbStream := cipher.NewOFB(block, nil)
69-
ofbStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: OFB. init from lines 28,68."
69+
ofbStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="DES. blockMode: OFB. init from 1,41 lines above."
7070
}
7171

7272
func BlockCipherTripleDes() {
7373
// BAD, triple des is a weak crypto algorithm and secretByteSlice is sensitive data
7474
block, _ := des.NewTripleDESCipher(nil)
7575

76-
block.Encrypt(dst, getUserID()) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from line 74."
76+
block.Encrypt(dst, getUserID()) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from 2 lines above."
7777
block.Decrypt(dst, getUserID())
7878

7979
gcm1, _ := cipher.NewGCM(block)
80-
gcm1.Seal(nil, nil, getUserID(), nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from line 74."
80+
gcm1.Seal(nil, nil, getUserID(), nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from 6 lines above."
8181
gcm1.Open(nil, nil, getUserID(), nil)
8282

8383
gcm2, _ := cipher.NewGCMWithNonceSize(block, 12)
84-
gcm2.Seal(nil, nil, getUserID(), nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from line 74."
84+
gcm2.Seal(nil, nil, getUserID(), nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from 10 lines above."
8585
gcm2.Open(nil, nil, getUserID(), nil)
8686

8787
gcm3, _ := cipher.NewGCMWithRandomNonce(block)
88-
gcm3.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from line 74."
88+
gcm3.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from 14 lines above."
8989
gcm3.Open(nil, nil, secretByteSlice, nil)
9090

9191
gcm4, _ := cipher.NewGCMWithTagSize(block, 12)
92-
gcm4.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from line 74."
92+
gcm4.Seal(nil, nil, secretByteSlice, nil) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. init from 18 lines above."
9393
gcm4.Open(nil, nil, secretByteSlice, nil)
9494

9595
cbcEncrypter := cipher.NewCBCEncrypter(block, nil)
96-
cbcEncrypter.CryptBlocks(dst, getUserID()) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CBC. init from lines 74,95."
96+
cbcEncrypter.CryptBlocks(dst, getUserID()) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CBC. init from 1,22 lines above."
9797
cipher.NewCBCDecrypter(block, nil).CryptBlocks(dst, getUserID())
9898

9999
ctrStream := cipher.NewCTR(block, nil)
100-
ctrStream.XORKeyStream(dst, getUserID()) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CTR. init from lines 74,99."
100+
ctrStream.XORKeyStream(dst, getUserID()) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CTR. init from 1,26 lines above."
101101

102-
ctrStreamReader := &cipher.StreamReader{S: ctrStream, R: bytes.NewReader(getUserID())} // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CTR. init from lines 74,99."
102+
ctrStreamReader := &cipher.StreamReader{S: ctrStream, R: bytes.NewReader(getUserID())} // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CTR. init from 28,3 lines above."
103103
io.Copy(os.Stdout, ctrStreamReader)
104104

105-
ctrStreamWriter := &cipher.StreamWriter{S: ctrStream, W: os.Stdout} // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CTR. init from lines 74,99."
106-
io.Copy(ctrStreamWriter, bytes.NewReader(getUserID())) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CTR. init from lines 74,99."
105+
ctrStreamWriter := &cipher.StreamWriter{S: ctrStream, W: os.Stdout} // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CTR. init from 31,6 lines above."
106+
io.Copy(ctrStreamWriter, bytes.NewReader(getUserID())) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CTR. init from 32,7 lines above."
107107

108108
// deprecated
109109

110110
cfbStream := cipher.NewCFBEncrypter(block, nil)
111-
cfbStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CFB. init from lines 110,74."
111+
cfbStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: CFB. init from 1,37 lines above."
112112
cipher.NewCFBDecrypter(block, nil).XORKeyStream(dst, secretByteSlice)
113113

114114
ofbStream := cipher.NewOFB(block, nil)
115-
ofbStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: OFB. init from lines 114,74."
115+
ofbStream.XORKeyStream(dst, secretByteSlice) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="TRIPLEDES. blockMode: OFB. init from 1,41 lines above."
116116
}
117117

118118
func BlockCipherAes() {
119119
// GOOD, aes is a strong crypto algorithm
120120
block, _ := aes.NewCipher(nil)
121121

122-
block.Encrypt(dst, secretByteSlice) // $ CryptographicOperation="AES. init from line 120."
122+
block.Encrypt(dst, secretByteSlice) // $ CryptographicOperation="AES. init from 2 lines above."
123123
block.Decrypt(dst, secretByteSlice)
124124

125125
gcm1, _ := cipher.NewGCM(block)
126-
gcm1.Seal(nil, nil, secretByteSlice, nil) // $ CryptographicOperation="AES. init from line 120."
126+
gcm1.Seal(nil, nil, secretByteSlice, nil) // $ CryptographicOperation="AES. init from 6 lines above."
127127
gcm1.Open(nil, nil, secretByteSlice, nil)
128128

129129
gcm2, _ := cipher.NewGCMWithNonceSize(block, 12)
130-
gcm2.Seal(nil, nil, secretByteSlice, nil) // $ CryptographicOperation="AES. init from line 120."
130+
gcm2.Seal(nil, nil, secretByteSlice, nil) // $ CryptographicOperation="AES. init from 10 lines above."
131131
gcm2.Open(nil, nil, secretByteSlice, nil)
132132

133133
gcm3, _ := cipher.NewGCMWithRandomNonce(block)
134-
gcm3.Seal(nil, nil, secretByteSlice, nil) // $ CryptographicOperation="AES. init from line 120."
134+
gcm3.Seal(nil, nil, secretByteSlice, nil) // $ CryptographicOperation="AES. init from 14 lines above."
135135
gcm3.Open(nil, nil, secretByteSlice, nil)
136136

137137
gcm4, _ := cipher.NewGCMWithTagSize(block, 12)
138-
gcm4.Seal(nil, nil, secretByteSlice, nil) // $ CryptographicOperation="AES. init from line 120."
138+
gcm4.Seal(nil, nil, secretByteSlice, nil) // $ CryptographicOperation="AES. init from 18 lines above."
139139
gcm4.Open(nil, nil, secretByteSlice, nil)
140140

141141
cbcEncrypter := cipher.NewCBCEncrypter(block, nil)
142-
cbcEncrypter.CryptBlocks(dst, secretByteSlice) // $ CryptographicOperation="AES. blockMode: CBC. init from lines 120,141."
142+
cbcEncrypter.CryptBlocks(dst, secretByteSlice) // $ CryptographicOperation="AES. blockMode: CBC. init from 1,22 lines above."
143143
cipher.NewCBCDecrypter(block, nil).CryptBlocks(dst, secretByteSlice)
144144

145145
ctrStream := cipher.NewCTR(block, nil)
146-
ctrStream.XORKeyStream(dst, secretByteSlice) // $ CryptographicOperation="AES. blockMode: CTR. init from lines 120,145."
146+
ctrStream.XORKeyStream(dst, secretByteSlice) // $ CryptographicOperation="AES. blockMode: CTR. init from 1,26 lines above."
147147

148-
ctrStreamReader := &cipher.StreamReader{S: ctrStream, R: bytes.NewReader(secretByteSlice)} // $ CryptographicOperation="AES. blockMode: CTR. init from lines 120,145."
148+
ctrStreamReader := &cipher.StreamReader{S: ctrStream, R: bytes.NewReader(secretByteSlice)} // $ CryptographicOperation="AES. blockMode: CTR. init from 28,3 lines above."
149149
io.Copy(os.Stdout, ctrStreamReader)
150150

151-
ctrStreamWriter := &cipher.StreamWriter{S: ctrStream, W: os.Stdout} // $ CryptographicOperation="AES. blockMode: CTR. init from lines 120,145."
152-
io.Copy(ctrStreamWriter, bytes.NewReader(secretByteSlice)) // $ CryptographicOperation="AES. blockMode: CTR. init from lines 120,145."
151+
ctrStreamWriter := &cipher.StreamWriter{S: ctrStream, W: os.Stdout} // $ CryptographicOperation="AES. blockMode: CTR. init from 31,6 lines above."
152+
io.Copy(ctrStreamWriter, bytes.NewReader(secretByteSlice)) // $ CryptographicOperation="AES. blockMode: CTR. init from 32,7 lines above."
153153

154154
// deprecated
155155

156156
cfbStream := cipher.NewCFBEncrypter(block, nil)
157-
cfbStream.XORKeyStream(dst, secretByteSlice) // $ CryptographicOperation="AES. blockMode: CFB. init from lines 120,156."
157+
cfbStream.XORKeyStream(dst, secretByteSlice) // $ CryptographicOperation="AES. blockMode: CFB. init from 1,37 lines above."
158158
cipher.NewCFBDecrypter(block, nil).XORKeyStream(dst, secretByteSlice)
159159

160160
ofbStream := cipher.NewOFB(block, nil)
161-
ofbStream.XORKeyStream(dst, secretByteSlice) // $ CryptographicOperation="AES. blockMode: OFB. init from lines 120,160."
161+
ofbStream.XORKeyStream(dst, secretByteSlice) // $ CryptographicOperation="AES. blockMode: OFB. init from 1,41 lines above."
162162
}
163163

164164
func CipherRc4() {
165165
c, _ := rc4.NewCipher(nil)
166-
c.XORKeyStream(dst, getUserID()) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="RC4. init from line 166."
166+
c.XORKeyStream(dst, getUserID()) // $ Alert[go/weak-cryptographic-algorithm] CryptographicOperation="RC4. init from 0 lines above."
167167
}

0 commit comments

Comments
 (0)