Java/BrokenCryptoAlgorithmQuery

d10c · d10c · commit 3ee393bc689b · 2025-10-08T14:59:49.000+02:00
java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
diff --git a/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll b/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll
@@ -35,6 +35,8 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.getLocation()
+    or
     exists(CryptoAlgoSpec c | sink.asExpr() = c.getAlgoSpec() | result = c.getLocation())
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -35,6 +35,8 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {`
`35`	`35`	`predicate observeDiffInformedIncrementalMode() { any() }`
`36`	`36`
`37`	`37`	`Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`38`	`+ result = sink.getLocation()`
	`39`	`+ or`
`38`	`40`	`exists(CryptoAlgoSpec c \| sink.asExpr() = c.getAlgoSpec() \| result = c.getLocation())`
`39`	`41`	`}`
`40`	`42`	`}`