circle-ir 3.51.0 → 3.53.0

package/dist/analysis/passes/weak-crypto-pass.js

@@ -0,0 +1,392 @@
+/**
+ * Pass: weak-crypto (CWE-327 / CWE-329 / CWE-321 / CWE-326, category: security)
+ *
+ * Pattern pass — flags use of cryptographically weak symmetric ciphers
+ * (DES, 3DES, RC2, RC4, Blowfish), ECB mode, weak RSA key sizes (< 2048),
+ * static/zero IVs (CWE-329), hardcoded symmetric keys (CWE-321), and weak
+ * AES modes. Like weak-hash, the vulnerability is the *constant algorithm
+ * string*, *constant IV bytes*, *literal key material*, or *key-size
+ * argument*, not data flow.
+ *
+ * Detection per language:
+ *   Java:
+ *     - `Cipher.getInstance("DES"|"DES/...")` / `"RC4"` / `"RC2"` / `"Blowfish"`
+ *     - `Cipher.getInstance(".../ECB/...")` — ECB mode
+ *     - `KeyGenerator.getInstance("DES"|"RC4"|"Blowfish")`
+ *     - `new IvParameterSpec(new byte[N])` / `new IvParameterSpec(literalBytes)`
+ *       — static/zero IV (CWE-329, issue #87)
+ *     - `new SecretKeySpec("literal".getBytes(), ...)` — hardcoded symmetric
+ *       key (CWE-321, issue #87)
+ *     - `KeyPairGenerator.initialize(<2048)` — weak RSA key size (CWE-326,
+ *       issue #87). Detected by literal `< 2048` argument on `initialize`
+ *       calls whose receiver is a `KeyPairGenerator` (best-effort: matches
+ *       any `*.initialize(int)` where the literal is below 2048, since
+ *       2048+ is also the minimum for DSA / DH and 256+ is correct for EC).
+ *   Python:
+ *     - `Crypto.Cipher.DES.new(...)` / `Crypto.Cipher.ARC4.new(...)` /
+ *       `Crypto.Cipher.Blowfish.new(...)` (pycryptodome / pycrypto)
+ *     - `cryptography.hazmat.primitives.ciphers.algorithms.{TripleDES,Blowfish,ARC4,IDEA,SEED,CAST5}`
+ *     - `AES.new(key, AES.MODE_ECB)` — ECB mode argument
+ *   JavaScript / TypeScript:
+ *     - `crypto.createCipher(...)` (deprecated; always weak)
+ *     - `crypto.createCipheriv("des-..."|"rc4"|"bf-..."|"des-ede"|".*-ecb")`
+ *   Go:
+ *     - `des.NewCipher(...)` / `des.NewTripleDESCipher(...)` / `rc4.NewCipher(...)`
+ *       (from `crypto/des` and `crypto/rc4`)
+ *     - `cipher.NewECBEncrypter(...)` (custom ECB wrappers — best-effort)
+ *
+ * Aligned with: gosec G401/G405, Bandit B304/B305/B306, OWASP Benchmark `crypto` category.
+ */
+// Weak symmetric ciphers (algorithm name set, lowercased).
+const WEAK_CIPHER_BASES = new Set([
+    'des', '3des', 'desede', 'tripledes',
+    'rc2', 'rc4', 'arc4',
+    'blowfish', 'bf',
+    'idea', 'seed', 'cast5',
+]);
+// Java cipher transformation regex: "ALG/MODE/PADDING"; we look at base and mode.
+function classifyJavaCipherSpec(spec) {
+    const parts = spec.split('/').map((p) => p.trim().toLowerCase());
+    const base = parts[0] ?? '';
+    const mode = parts[1] ?? '';
+    const result = {};
+    if (WEAK_CIPHER_BASES.has(base))
+        result.weakBase = base;
+    if (mode === 'ecb')
+        result.ecb = true;
+    // Java default when only base is given is ECB (Cipher.getInstance("AES") == AES/ECB/PKCS5).
+    if (parts.length === 1 && base === 'aes')
+        result.ecb = true;
+    return result;
+}
+function stripQuotes(s) {
+    const t = s.trim();
+    if ((t.startsWith('"') && t.endsWith('"')) ||
+        (t.startsWith("'") && t.endsWith("'")) ||
+        (t.startsWith('`') && t.endsWith('`'))) {
+        return t.slice(1, -1);
+    }
+    return t;
+}
+function literalAlgo(call, position) {
+    const arg = call.arguments.find((a) => a.position === position);
+    if (!arg)
+        return null;
+    const raw = arg.literal ?? arg.expression ?? '';
+    const cleaned = stripQuotes(raw);
+    return cleaned || null;
+}
+/**
+ * Detect a static or zero IV passed to `new IvParameterSpec(...)`.
+ *
+ * Patterns flagged (returns a human-readable detail string):
+ *   - `new byte[N]`               → "zero-filled byte[N]"
+ *   - `new byte[]{0x00, 0x01,…}`  → "literal byte[] {…}"
+ *   - `"literal".getBytes()`      → "literal string getBytes()"
+ *   - bare string literal         → "literal string"
+ *
+ * Returns null when the IV argument is a variable / method call whose
+ * value cannot be determined as a constant.
+ */
+function detectStaticIvJava(call) {
+    const arg = call.arguments.find((a) => a.position === 0);
+    if (!arg)
+        return null;
+    const expr = (arg.literal ?? arg.expression ?? '').trim();
+    if (!expr)
+        return null;
+    // `new byte[16]` / `new byte[BLOCK_SIZE]` — zero-initialised array literal.
+    // Java initialises primitive arrays to zero, so a fresh `new byte[N]`
+    // (without an immediate assignment of random bytes) is always a zero IV.
+    if (/^new\s+byte\s*\[[^\]]*\]\s*$/.test(expr)) {
+        return `zero-filled ${expr}`;
+    }
+    // `new byte[]{0x00, …}` — literal byte array initializer.
+    if (/^new\s+byte\s*\[\s*\]\s*\{[^}]*\}\s*$/.test(expr)) {
+        return `literal byte[] initializer`;
+    }
+    // `"…".getBytes()` / `"…".getBytes("UTF-8")` — constant string source.
+    if (/^"[^"]*"\.getBytes\s*\(/.test(expr)) {
+        return `literal string .getBytes()`;
+    }
+    // Bare string literal (rare for IvParameterSpec but possible via overload).
+    if (/^"[^"]*"$/.test(expr)) {
+        return `literal string`;
+    }
+    return null;
+}
+/**
+ * Detect a hardcoded symmetric key passed to `new SecretKeySpec(...)`.
+ *
+ * Patterns flagged:
+ *   - `"literalKey".getBytes()`   → "literal string .getBytes()"
+ *   - `"literalKey".getBytes("…")`
+ *   - `new byte[]{0x00, …}`       → "literal byte[] initializer"
+ *   - bare string literal         → "literal string"
+ *
+ * Returns null when the key argument is a variable, method call, or any
+ * other non-literal expression.
+ */
+/**
+ * Recognise a Java constructor call to `new ClassName(...)`.
+ *
+ * The Java language plugin emits constructor calls as `CallInfo` with:
+ *   method_name    === ClassName
+ *   receiver       === null
+ *   receiver_type  === ClassName (or FQN tail)
+ *
+ * Match on that shape, plus the explicit `is_constructor` flag when set.
+ */
+function isJavaCtor(call, className) {
+    if (call.is_constructor === true)
+        return true;
+    if (call.receiver)
+        return false;
+    if (call.receiver_type === className)
+        return true;
+    if ((call.receiver_type_fqn ?? '').endsWith('.' + className))
+        return true;
+    return false;
+}
+function detectHardcodedKeyJava(call) {
+    const arg = call.arguments.find((a) => a.position === 0);
+    if (!arg)
+        return null;
+    const expr = (arg.literal ?? arg.expression ?? '').trim();
+    if (!expr)
+        return null;
+    if (/^"[^"]*"\.getBytes\s*\(/.test(expr))
+        return `literal string .getBytes()`;
+    if (/^new\s+byte\s*\[\s*\]\s*\{[^}]*\}\s*$/.test(expr))
+        return `literal byte[] initializer`;
+    if (/^"[^"]*"$/.test(expr))
+        return `literal string`;
+    return null;
+}
+/** Map issue kind → CWE identifier. */
+const ISSUE_CWE = {
+    'weak-cipher': 'CWE-327',
+    'ecb-mode': 'CWE-327',
+    'deprecated-api': 'CWE-327',
+    'static-iv': 'CWE-329',
+    'hardcoded-key': 'CWE-321',
+    'weak-rsa-key': 'CWE-326',
+};
+export class WeakCryptoPass {
+    name = 'weak-crypto';
+    category = 'security';
+    run(ctx) {
+        const { graph, language } = ctx;
+        const file = graph.ir.meta.file;
+        const findings = [];
+        for (const call of graph.ir.calls) {
+            const detections = this.detect(call, language);
+            for (const det of detections) {
+                const line = call.location.line;
+                findings.push({ line, language, ...det });
+                const message = this.buildMessage(det);
+                ctx.addFinding({
+                    id: `${this.name}-${file}-${line}-${det.issue}`,
+                    pass: this.name,
+                    category: this.category,
+                    rule_id: this.name,
+                    cwe: ISSUE_CWE[det.issue],
+                    severity: 'high',
+                    level: 'error',
+                    message,
+                    file,
+                    line,
+                    fix: this.buildFix(det.issue),
+                    evidence: { ...det, language },
+                });
+            }
+        }
+        return { findings };
+    }
+    buildMessage(det) {
+        switch (det.issue) {
+            case 'weak-cipher':
+                return (`Weak symmetric cipher \`${det.detail.toUpperCase()}\` used via ` +
+                    `\`${det.api}\`. DES, 3DES, RC2, RC4, Blowfish, and IDEA/SEED/CAST5 ` +
+                    'are deprecated and broken at modern key sizes.');
+            case 'ecb-mode':
+                return (`ECB block-cipher mode used via \`${det.api}\` (\`${det.detail}\`). ` +
+                    'ECB leaks plaintext structure (identical blocks → identical ciphertext) ' +
+                    'and is not semantically secure.');
+            case 'deprecated-api':
+                return (`Deprecated crypto API \`${det.api}\` used (no IV: \`${det.detail}\`). ` +
+                    'This API derives the key/IV from a password in an insecure way.');
+            case 'static-iv':
+                return (`Static or zero-valued IV passed to \`${det.api}\` (\`${det.detail}\`). ` +
+                    'Reusing a fixed IV with CBC/CTR/GCM breaks confidentiality and, for ' +
+                    'GCM, can leak the authentication key.');
+            case 'hardcoded-key':
+                return (`Hardcoded symmetric key material passed to \`${det.api}\` (\`${det.detail}\`). ` +
+                    'Keys embedded in source code are trivially recoverable from binaries ' +
+                    'and shared across deployments — they provide no confidentiality.');
+            case 'weak-rsa-key':
+                return (`Weak RSA key size \`${det.detail}\` requested via \`${det.api}\`. ` +
+                    'RSA keys below 2048 bits are factorable and not compliant with ' +
+                    'NIST SP 800-57 / FIPS 186-5.');
+            default:
+                return `Weak cryptography: ${det.detail} (${det.api})`;
+        }
+    }
+    buildFix(issue) {
+        switch (issue) {
+            case 'static-iv':
+                return ('Generate a fresh random IV per message using SecureRandom: ' +
+                    '`byte[] iv = new byte[12]; SecureRandom.getInstanceStrong().nextBytes(iv); ' +
+                    'new IvParameterSpec(iv);` and prepend it to the ciphertext.');
+            case 'hardcoded-key':
+                return ('Load the key from a secure key management system (HSM, KMS, ' +
+                    'Vault) or platform keystore. Never embed key material in source code.');
+            case 'weak-rsa-key':
+                return ('Initialize KeyPairGenerator with at least 2048 bits (preferably ' +
+                    '3072 or 4096) for RSA, or switch to EC keys (P-256+).');
+            default:
+                return ('Use AES-GCM (authenticated) or ChaCha20-Poly1305. Avoid DES, ' +
+                    '3DES, RC2, RC4, Blowfish, and ECB mode. For asymmetric encryption ' +
+                    'use RSA-OAEP with ≥2048-bit keys or modern curve-based schemes.');
+        }
+    }
+    detect(call, language) {
+        const method = call.method_name;
+        const receiver = call.receiver ?? '';
+        const out = [];
+        if (language === 'java') {
+            // Cipher.getInstance(...) / KeyGenerator.getInstance(...)
+            const isCipherFactory = method === 'getInstance' &&
+                (receiver === 'Cipher' || receiver.endsWith('.Cipher') ||
+                    receiver === 'KeyGenerator' || receiver.endsWith('.KeyGenerator'));
+            if (isCipherFactory) {
+                const spec = literalAlgo(call, 0);
+                if (spec) {
+                    const { weakBase, ecb } = classifyJavaCipherSpec(spec);
+                    const api = `${receiver}.getInstance`;
+                    if (weakBase)
+                        out.push({ issue: 'weak-cipher', detail: weakBase, api });
+                    if (ecb)
+                        out.push({ issue: 'ecb-mode', detail: spec, api });
+                }
+            }
+            // new IvParameterSpec(...) — issue #87 (CWE-329 static IV)
+            // Java constructor IR shape: method_name === 'IvParameterSpec',
+            // receiver === null, receiver_type === 'IvParameterSpec'. The
+            // is_constructor flag is not always populated by the Java plugin,
+            // so detect by class-name match.
+            if (method === 'IvParameterSpec' && isJavaCtor(call, 'IvParameterSpec')) {
+                const ivDetail = detectStaticIvJava(call);
+                if (ivDetail) {
+                    out.push({ issue: 'static-iv', detail: ivDetail, api: 'new IvParameterSpec' });
+                }
+            }
+            // new SecretKeySpec(literal.getBytes(), "ALG") — issue #87 (CWE-321 hardcoded key)
+            if (method === 'SecretKeySpec' && isJavaCtor(call, 'SecretKeySpec')) {
+                const keyDetail = detectHardcodedKeyJava(call);
+                if (keyDetail) {
+                    out.push({ issue: 'hardcoded-key', detail: keyDetail, api: 'new SecretKeySpec' });
+                }
+            }
+            // kpg.initialize(<2048) — issue #87 (CWE-326 weak RSA key size)
+            // KeyPairGenerator instance method. Receiver_type === 'KeyPairGenerator'
+            // when the language plugin resolves it (post receiver-type matcher fix #52).
+            if (method === 'initialize') {
+                const isKpg = call.receiver_type === 'KeyPairGenerator' ||
+                    (call.receiver_type_fqn ?? '').endsWith('.KeyPairGenerator');
+                if (isKpg) {
+                    const sizeArg = call.arguments.find((a) => a.position === 0);
+                    const expr = (sizeArg?.literal ?? sizeArg?.expression ?? '').trim();
+                    const n = parseInt(expr, 10);
+                    if (Number.isFinite(n) && n > 0 && n < 2048) {
+                        out.push({
+                            issue: 'weak-rsa-key',
+                            detail: String(n),
+                            api: 'KeyPairGenerator.initialize',
+                        });
+                    }
+                }
+            }
+            return out;
+        }
+        if (language === 'python') {
+            // Crypto.Cipher.DES.new(...) / ARC4.new(...) / Blowfish.new(...)
+            // pycryptodome receiver shape: `Crypto.Cipher.DES` or just `DES` (after import).
+            if (method === 'new') {
+                const rcvLower = receiver.toLowerCase();
+                const lastSeg = rcvLower.split('.').pop() ?? rcvLower;
+                if (WEAK_CIPHER_BASES.has(lastSeg)) {
+                    out.push({ issue: 'weak-cipher', detail: lastSeg, api: `${receiver}.new` });
+                }
+                // AES.new(key, AES.MODE_ECB) — ECB mode argument
+                if (lastSeg === 'aes' || lastSeg.endsWith('.aes')) {
+                    const mode = call.arguments.find((a) => a.position === 1);
+                    const modeExpr = (mode?.expression ?? '').trim();
+                    if (/\bMODE_ECB\b/.test(modeExpr)) {
+                        out.push({ issue: 'ecb-mode', detail: 'AES.MODE_ECB', api: `${receiver}.new` });
+                    }
+                }
+            }
+            // cryptography.hazmat ciphers — algorithms.TripleDES(key) / Blowfish(key) / ARC4(key) / IDEA(key) / SEED(key) / CAST5(key)
+            // Receiver here is `algorithms` (or full path); method is the algo name.
+            const isHazmatAlgos = receiver === 'algorithms' || receiver.endsWith('.algorithms');
+            if (isHazmatAlgos) {
+                const m = method.toLowerCase();
+                const normalized = m === 'tripledes' ? '3des' : m;
+                if (WEAK_CIPHER_BASES.has(normalized)) {
+                    out.push({ issue: 'weak-cipher', detail: normalized, api: `algorithms.${method}` });
+                }
+            }
+            return out;
+        }
+        if (language === 'javascript' || language === 'typescript') {
+            // crypto.createCipher(...) — deprecated, always weak (no IV).
+            if (method === 'createCipher' && receiver === 'crypto') {
+                const algo = literalAlgo(call, 0) ?? '<unknown>';
+                out.push({ issue: 'deprecated-api', detail: algo, api: 'crypto.createCipher' });
+            }
+            // crypto.createCipheriv("des-..."|"rc4"|"...-ecb"|...)
+            if (method === 'createCipheriv' && receiver === 'crypto') {
+                const algo = literalAlgo(call, 0);
+                if (algo) {
+                    const lower = algo.toLowerCase();
+                    // Split on dashes: "aes-128-ecb", "des-ede3-cbc", "rc4", "bf-cbc"
+                    const parts = lower.split('-');
+                    const base = parts[0];
+                    const mode = parts[parts.length - 1];
+                    let normalizedBase = base;
+                    if (base === 'bf')
+                        normalizedBase = 'blowfish';
+                    if (base === 'desede' || base === 'des-ede3' || base === 'des3')
+                        normalizedBase = '3des';
+                    if (WEAK_CIPHER_BASES.has(normalizedBase)) {
+                        out.push({ issue: 'weak-cipher', detail: normalizedBase, api: 'crypto.createCipheriv' });
+                    }
+                    if (mode === 'ecb') {
+                        out.push({ issue: 'ecb-mode', detail: lower, api: 'crypto.createCipheriv' });
+                    }
+                }
+            }
+            return out;
+        }
+        if (language === 'go') {
+            // crypto/des: des.NewCipher / des.NewTripleDESCipher
+            if (receiver === 'des' && (method === 'NewCipher' || method === 'NewTripleDESCipher')) {
+                const base = method === 'NewTripleDESCipher' ? '3des' : 'des';
+                out.push({ issue: 'weak-cipher', detail: base, api: `des.${method}` });
+            }
+            // crypto/rc4: rc4.NewCipher
+            if (receiver === 'rc4' && method === 'NewCipher') {
+                out.push({ issue: 'weak-cipher', detail: 'rc4', api: 'rc4.NewCipher' });
+            }
+            // ECB mode wrappers — cipher.NewECBEncrypter / NewECBDecrypter (custom helpers
+            // — Go stdlib intentionally omits ECB, so any such call is suspect).
+            if ((method === 'NewECBEncrypter' || method === 'NewECBDecrypter') && receiver === 'cipher') {
+                out.push({ issue: 'ecb-mode', detail: method, api: `cipher.${method}` });
+            }
+            return out;
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=weak-crypto-pass.js.map

package/dist/analysis/passes/weak-crypto-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-crypto-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/weak-crypto-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAKH,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW;IACpC,KAAK,EAAE,KAAK,EAAE,MAAM;IACpB,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,MAAM,EAAE,OAAO;CACxB,CAAC,CAAC;AAEH,kFAAkF;AAClF,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxD,IAAI,IAAI,KAAK,KAAK;QAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IACtC,4FAA4F;IAC5F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,KAAK;QAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IACE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACtC,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,QAAgB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAC,IAAc;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,OAAO,eAAe,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,0DAA0D;IAC1D,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,OAAO,4BAA4B,CAAC;IACtC,CAAC;IAED,uEAAuE;IACvE,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,4BAA4B,CAAC;IACtC,CAAC;IAED,4EAA4E;IAC5E,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,IAAc,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAc;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,4BAA4B,CAAC;IAC9E,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,4BAA4B,CAAC;IAC5F,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEpD,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,uCAAuC;AACvC,MAAM,SAAS,GAAoC;IACjD,aAAa,EAAE,SAAS;IACxB,UAAU,EAAE,SAAS;IACrB,gBAAgB,EAAE,SAAS;IAC3B,WAAW,EAAE,SAAS;IACtB,eAAe,EAAE,SAAS;IAC1B,cAAc,EAAE,SAAS;CAC1B,CAAC;AAYF,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,aAAa,CAAC;IACrB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC/C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;gBACvC,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;oBACzB,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,OAAO;oBACd,OAAO;oBACP,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;oBAC7B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,YAAY,CAAC,GAA4D;QAC/E,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,aAAa;gBAChB,OAAO,CACL,2BAA2B,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc;oBACjE,KAAK,GAAG,CAAC,GAAG,yDAAyD;oBACrE,gDAAgD,CACjD,CAAC;YACJ,KAAK,UAAU;gBACb,OAAO,CACL,oCAAoC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,MAAM,OAAO;oBACrE,0EAA0E;oBAC1E,iCAAiC,CAClC,CAAC;YACJ,KAAK,gBAAgB;gBACnB,OAAO,CACL,2BAA2B,GAAG,CAAC,GAAG,qBAAqB,GAAG,CAAC,MAAM,OAAO;oBACxE,iEAAiE,CAClE,CAAC;YACJ,KAAK,WAAW;gBACd,OAAO,CACL,wCAAwC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,MAAM,OAAO;oBACzE,sEAAsE;oBACtE,uCAAuC,CACxC,CAAC;YACJ,KAAK,eAAe;gBAClB,OAAO,CACL,gDAAgD,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,MAAM,OAAO;oBACjF,uEAAuE;oBACvE,kEAAkE,CACnE,CAAC;YACJ,KAAK,cAAc;gBACjB,OAAO,CACL,uBAAuB,GAAG,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM;oBACpE,iEAAiE;oBACjE,8BAA8B,CAC/B,CAAC;YACJ;gBACE,OAAO,sBAAsB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,KAAsB;QACrC,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,WAAW;gBACd,OAAO,CACL,6DAA6D;oBAC7D,6EAA6E;oBAC7E,6DAA6D,CAC9D,CAAC;YACJ,KAAK,eAAe;gBAClB,OAAO,CACL,8DAA8D;oBAC9D,uEAAuE,CACxE,CAAC;YACJ,KAAK,cAAc;gBACjB,OAAO,CACL,kEAAkE;oBAClE,uDAAuD,CACxD,CAAC;YACJ;gBACE,OAAO,CACL,+DAA+D;oBAC/D,oEAAoE;oBACpE,iEAAiE,CAClE,CAAC;QACN,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,IAAc,EAAE,QAAgB;QAK7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAmE,EAAE,CAAC;QAE/E,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,0DAA0D;YAC1D,MAAM,eAAe,GACnB,MAAM,KAAK,aAAa;gBACxB,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;oBACrD,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;YACtE,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClC,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;oBACvD,MAAM,GAAG,GAAG,GAAG,QAAQ,cAAc,CAAC;oBACtC,IAAI,QAAQ;wBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;oBACxE,IAAI,GAAG;wBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,gEAAgE;YAChE,8DAA8D;YAC9D,kEAAkE;YAClE,iCAAiC;YACjC,IAAI,MAAM,KAAK,iBAAiB,IAAI,UAAU,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBACxE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;YAED,mFAAmF;YACnF,IAAI,MAAM,KAAK,eAAe,IAAI,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;gBACpE,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBAC/C,IAAI,SAAS,EAAE,CAAC;oBACd,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;YAED,gEAAgE;YAChE,yEAAyE;YACzE,6EAA6E;YAC7E,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,KAAK,GACT,IAAI,CAAC,aAAa,KAAK,kBAAkB;oBACzC,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;gBAC/D,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;oBAC7D,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACpE,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;wBAC5C,GAAG,CAAC,IAAI,CAAC;4BACP,KAAK,EAAE,cAAc;4BACrB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;4BACjB,GAAG,EAAE,6BAA6B;yBACnC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,iEAAiE;YACjE,iFAAiF;YACjF,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;gBACtD,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,MAAM,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,iDAAiD;gBACjD,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjD,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAClC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,QAAQ,MAAM,EAAE,CAAC,CAAC;oBAClF,CAAC;gBACH,CAAC;YACH,CAAC;YACD,2HAA2H;YAC3H,yEAAyE;YACzE,MAAM,aAAa,GAAG,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACpF,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClD,IAAI,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,MAAM,EAAE,EAAE,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,8DAA8D;YAC9D,IAAI,MAAM,KAAK,cAAc,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC;gBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,uDAAuD;YACvD,IAAI,MAAM,KAAK,gBAAgB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACzD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClC,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjC,kEAAkE;oBAClE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACtB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBACrC,IAAI,cAAc,GAAG,IAAI,CAAC;oBAC1B,IAAI,IAAI,KAAK,IAAI;wBAAE,cAAc,GAAG,UAAU,CAAC;oBAC/C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM;wBAAE,cAAc,GAAG,MAAM,CAAC;oBACzF,IAAI,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;wBAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBAC3F,CAAC;oBACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;wBACnB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBAC/E,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,qDAAqD;YACrD,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,oBAAoB,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,GAAG,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,MAAM,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4BAA4B;YAC5B,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,+EAA+E;YAC/E,qEAAqE;YACrE,IAAI,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,iBAAiB,CAAC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC5F,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/analysis/passes/weak-hash-pass.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Pass: weak-hash (CWE-328, category: security)
+ *
+ * Pattern pass — flags use of cryptographically broken hash algorithms
+ * (MD2, MD4, MD5, SHA-1) for security purposes. The vulnerability is
+ * the *constant algorithm string*, not data flow: `MessageDigest.getInstance("MD5")`
+ * is always vulnerable regardless of input. Therefore this is implemented
+ * as call-site literal inspection, not as a taint sink.
+ *
+ * Detection per language:
+ *   Java:
+ *     - `MessageDigest.getInstance("MD5"|"SHA-1"|"SHA1"|"MD2"|"MD4")`
+ *     - `DigestUtils.md5(...)` / `md5Hex(...)` / `sha1(...)` / `sha1Hex(...)`
+ *       (Apache Commons Codec — method name encodes the algorithm)
+ *   Python:
+ *     - `hashlib.md5(...)` / `hashlib.sha1(...)` / `hashlib.md4(...)` / `hashlib.new("md5", ...)`
+ *   JavaScript / TypeScript:
+ *     - `crypto.createHash('md5'|'sha1'|'md4'|'md2')`
+ *     - `crypto.createHmac('md5'|'sha1', key)`
+ *   Go:
+ *     - `md5.New()` / `md5.Sum(...)` / `sha1.New()` / `sha1.Sum(...)`
+ *       (from `crypto/md5` and `crypto/sha1` packages)
+ *
+ * Aligned with: gosec G401, Bandit B303/B304, OWASP Benchmark `hash` category.
+ *
+ * Replaces (and supersedes) the broken taint-sink registration
+ * `{method:'getInstance', class:'MessageDigest', type:'weak_hash'}` that
+ * could never fire on a literal algorithm name.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+export interface WeakHashResult {
+    findings: Array<{
+        line: number;
+        language: string;
+        algorithm: string;
+        api: string;
+    }>;
+}
+export declare class WeakHashPass implements AnalysisPass<WeakHashResult> {
+    readonly name = "weak-hash";
+    readonly category: "security";
+    run(ctx: PassContext): WeakHashResult;
+    private detect;
+}
+//# sourceMappingURL=weak-hash-pass.d.ts.map

package/dist/analysis/passes/weak-hash-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-hash-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-hash-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAoB9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAsBD,qBAAa,YAAa,YAAW,YAAY,CAAC,cAAc,CAAC;IAC/D,QAAQ,CAAC,IAAI,eAAe;IAC5B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc;IAsCrC,OAAO,CAAC,MAAM;CA6Df"}

package/dist/analysis/passes/weak-hash-pass.js

@@ -0,0 +1,150 @@
+/**
+ * Pass: weak-hash (CWE-328, category: security)
+ *
+ * Pattern pass — flags use of cryptographically broken hash algorithms
+ * (MD2, MD4, MD5, SHA-1) for security purposes. The vulnerability is
+ * the *constant algorithm string*, not data flow: `MessageDigest.getInstance("MD5")`
+ * is always vulnerable regardless of input. Therefore this is implemented
+ * as call-site literal inspection, not as a taint sink.
+ *
+ * Detection per language:
+ *   Java:
+ *     - `MessageDigest.getInstance("MD5"|"SHA-1"|"SHA1"|"MD2"|"MD4")`
+ *     - `DigestUtils.md5(...)` / `md5Hex(...)` / `sha1(...)` / `sha1Hex(...)`
+ *       (Apache Commons Codec — method name encodes the algorithm)
+ *   Python:
+ *     - `hashlib.md5(...)` / `hashlib.sha1(...)` / `hashlib.md4(...)` / `hashlib.new("md5", ...)`
+ *   JavaScript / TypeScript:
+ *     - `crypto.createHash('md5'|'sha1'|'md4'|'md2')`
+ *     - `crypto.createHmac('md5'|'sha1', key)`
+ *   Go:
+ *     - `md5.New()` / `md5.Sum(...)` / `sha1.New()` / `sha1.Sum(...)`
+ *       (from `crypto/md5` and `crypto/sha1` packages)
+ *
+ * Aligned with: gosec G401, Bandit B303/B304, OWASP Benchmark `hash` category.
+ *
+ * Replaces (and supersedes) the broken taint-sink registration
+ * `{method:'getInstance', class:'MessageDigest', type:'weak_hash'}` that
+ * could never fire on a literal algorithm name.
+ */
+const WEAK_HASH_NAMES = new Set([
+    'md2', 'md4', 'md5',
+    'sha-1', 'sha1',
+]);
+// Apache Commons Codec DigestUtils — method name encodes algorithm.
+const COMMONS_DIGEST_METHODS = new Set([
+    'md2', 'md2Hex',
+    'md5', 'md5Hex',
+    'sha1', 'sha1Hex',
+    // Apache Commons also has the misnamed `sha(...)` which is SHA-1
+    'sha', 'shaHex',
+]);
+// Python hashlib direct constructors
+const PY_HASHLIB_WEAK = new Set(['md5', 'sha1', 'md4', 'md2', 'new']);
+function stripQuotes(s) {
+    const trimmed = s.trim();
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+        (trimmed.startsWith("'") && trimmed.endsWith("'")) ||
+        (trimmed.startsWith('`') && trimmed.endsWith('`'))) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+function literalAlgo(call, position) {
+    const arg = call.arguments.find((a) => a.position === position);
+    if (!arg)
+        return null;
+    const raw = arg.literal ?? arg.expression ?? '';
+    const cleaned = stripQuotes(raw).toLowerCase();
+    return cleaned || null;
+}
+export class WeakHashPass {
+    name = 'weak-hash';
+    category = 'security';
+    run(ctx) {
+        const { graph, language } = ctx;
+        const file = graph.ir.meta.file;
+        const findings = [];
+        for (const call of graph.ir.calls) {
+            const detection = this.detect(call, language);
+            if (!detection)
+                continue;
+            const { algorithm, api } = detection;
+            const line = call.location.line;
+            findings.push({ line, language, algorithm, api });
+            ctx.addFinding({
+                id: `${this.name}-${file}-${line}`,
+                pass: this.name,
+                category: this.category,
+                rule_id: this.name,
+                cwe: 'CWE-328',
+                severity: 'medium',
+                level: 'warning',
+                message: `Weak hash algorithm \`${algorithm.toUpperCase()}\` used via \`${api}\`. ` +
+                    'MD2/MD4/MD5/SHA-1 are cryptographically broken and must not be used ' +
+                    'for passwords, signatures, integrity checks, or anywhere collision ' +
+                    'resistance is required.',
+                file,
+                line,
+                fix: 'Use SHA-256 or stronger (SHA-384, SHA-512, SHA-3). For passwords, ' +
+                    'use a password-hashing function: bcrypt, scrypt, Argon2, or PBKDF2.',
+                evidence: { algorithm, api, language },
+            });
+        }
+        return { findings };
+    }
+    detect(call, language) {
+        const method = call.method_name;
+        const receiver = call.receiver ?? '';
+        if (language === 'java') {
+            // MessageDigest.getInstance("MD5")
+            if (method === 'getInstance' && (receiver === 'MessageDigest' || receiver.endsWith('.MessageDigest'))) {
+                const algo = literalAlgo(call, 0);
+                if (algo && WEAK_HASH_NAMES.has(algo)) {
+                    return { algorithm: algo, api: 'MessageDigest.getInstance' };
+                }
+            }
+            // Apache Commons Codec — DigestUtils.md5Hex(...), .sha1(...), etc.
+            if (COMMONS_DIGEST_METHODS.has(method) && (receiver === 'DigestUtils' || receiver.endsWith('.DigestUtils'))) {
+                const algoFromMethod = method.toLowerCase().replace(/hex$/, '');
+                const normalized = algoFromMethod === 'sha' ? 'sha1' : algoFromMethod;
+                return { algorithm: normalized, api: `DigestUtils.${method}` };
+            }
+            return null;
+        }
+        if (language === 'python') {
+            // hashlib.md5(...), .sha1(...), .md4(...), .md2(...)
+            if ((receiver === 'hashlib' || receiver.endsWith('.hashlib')) && PY_HASHLIB_WEAK.has(method)) {
+                if (method === 'new') {
+                    const algo = literalAlgo(call, 0);
+                    if (algo && WEAK_HASH_NAMES.has(algo)) {
+                        return { algorithm: algo, api: 'hashlib.new' };
+                    }
+                    return null;
+                }
+                return { algorithm: method, api: `hashlib.${method}` };
+            }
+            return null;
+        }
+        if (language === 'javascript' || language === 'typescript') {
+            // crypto.createHash('md5') / crypto.createHmac('sha1', key)
+            if ((method === 'createHash' || method === 'createHmac') && receiver === 'crypto') {
+                const algo = literalAlgo(call, 0);
+                if (algo && WEAK_HASH_NAMES.has(algo)) {
+                    return { algorithm: algo, api: `crypto.${method}` };
+                }
+            }
+            return null;
+        }
+        if (language === 'go') {
+            // md5.New() / md5.Sum(...) / sha1.New() / sha1.Sum(...)
+            const isWeakPkg = receiver === 'md5' || receiver === 'sha1';
+            if (isWeakPkg && (method === 'New' || method === 'Sum')) {
+                return { algorithm: receiver, api: `${receiver}.${method}` };
+            }
+            return null;
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=weak-hash-pass.js.map

package/dist/analysis/passes/weak-hash-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-hash-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/weak-hash-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,KAAK,EAAE,KAAK;IACnB,OAAO,EAAE,MAAM;CAChB,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,iEAAiE;IACjE,KAAK,EAAE,QAAQ;CAChB,CAAC,CAAC;AAEH,qCAAqC;AACrC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAWtE,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,QAAgB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,YAAY;IACd,IAAI,GAAG,WAAW,CAAC;IACnB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAA+B,EAAE,CAAC;QAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAElD,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,yBAAyB,SAAS,CAAC,WAAW,EAAE,iBAAiB,GAAG,MAAM;oBAC1E,sEAAsE;oBACtE,qEAAqE;oBACrE,yBAAyB;gBAC3B,IAAI;gBACJ,IAAI;gBACJ,GAAG,EACD,oEAAoE;oBACpE,qEAAqE;gBACvE,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,IAAc,EAAE,QAAgB;QAI7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,mCAAmC;YACnC,IAAI,MAAM,KAAK,aAAa,IAAI,CAAC,QAAQ,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBACtG,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClC,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,mEAAmE;YACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;gBAC5G,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChE,MAAM,UAAU,GAAG,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;gBACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,MAAM,EAAE,EAAE,CAAC;YACjE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,qDAAqD;YACrD,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7F,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClC,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;oBACjD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,4DAA4D;YAC5D,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,YAAY,CAAC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClC,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;gBACtD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,wDAAwD;YACxD,MAAM,SAAS,GAAG,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM,CAAC;YAC5D,IAAI,SAAS,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}