Java: Add missing broken crypto algorithms

[luchua-bc]

Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted.

The ECB encryption mode is vulnerable to replay attacks and the CBC mode of operation with PKCS#5 (or PKCS#7) padding is vulnerable to padding oracle attacks. These two types of algorithms are widely treated as insecure/broken cryptographic algorithms in modern standards.

Some references are:

1. Test cases for risky or broken cryptographic algorithm erroneously labeled as not vulnerable #92 - OWASP Test Cases
2. codeql/csharp/ql/src/Security Features/Encryption using ECB.ql - C# Query for Encryption using ECB
3. AES encryption algorithm should be used with secured mode - SonarSource Rule RSPEC-4432
4. CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

This query adds these two categories to the list of insecure ciphers.

Please consider to merge this PR. Thanks.

[aschackmull]

LGTM.

[smowton]

Looks like you got a real test failure in ql/java/ql/test/library-tests/Encryption/cryptoalgospec.ql

[aschackmull]

Looks like there are actually 2 test failures:
ql/java/ql/test/library-tests/Encryption/cryptoalgospec.ql: Test failure (Expected output does not match)
ql/java/ql/test/library-tests/Encryption/secure.ql: Test failure (Expected output does not match)

[luchua-bc]

Sorry I should have checked the other two test cases as well instead of insecure.ql only. I'm trying to exclude those two new patterns from the regex match in getASecureAlgorithmName() so that secure.ql can pass.

Please advise if there is a better approach to resolve this issue. Thanks.

[luchua-bc]

I've removed those algorithms from the list of secure algorithms. Please review.

Thanks,
@luchua-bc