-
Notifications
You must be signed in to change notification settings - Fork 0
/
CA5390_1.yaml
44 lines (44 loc) · 1.24 KB
/
CA5390_1.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
rules:
- id: CA5390_1
patterns:
- pattern-inside: |
using System.Security.Cryptography;
...
- pattern-either:
- pattern: |
public $T $F($X){
...
SymmetricAlgorithm $VAR = SymmetricAlgorithm.Create();
...
byte[] $B = $DATA;
...
$VAR.$FUNC($B, $X);
...
}
- pattern: |
public $T $F($X){
...
byte[] $B = $DATA;
...
SymmetricAlgorithm $VAR = SymmetricAlgorithm.Create();
...
$VAR.$FUNC($B, $X);
...
}
- metavariable-pattern:
metavariable: $DATA
patterns:
- pattern-either:
- pattern: new byte[]{...}
- pattern: Encoding.ASCII.GetBytes("...")
- pattern: Convert.FromBase64String("...")
- metavariable-regex:
metavariable: $FUNC
regex: (CreateEncryptor|CreateDecryptor)
message: Do not hard-code encryption key
languages: [csharp]
metadata:
cwe: 'CWE-321: Use of Hard-coded Cryptographic Key'
references:
- https://docs.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5390
severity: WARNING