search

0xdea / semgrep-rules

A collection of my Semgrep rules to facilitate vulnerability research.
https://semgrep.dev
MIT License
541 stars 54 forks source link

cryptographic misuse rules #6

Closed firmianay closed 2 years ago

firmianay commented 2 years ago

Is it possible to add a check item for misuse of cryptography, such as MD5, which has been regarded as insecure, the check method may be an insecure-api-MD5_Init.yaml

0xdea commented 2 years ago

It's certainly possible to check for potentially insecure code patterns related to cryptographic functions. In fact, here's a simple example: https://github.com/0xdea/semgrep-rules/blob/main/generic/bad-words.yaml#L49

That said, I haven't included specific rules for C/C++ as these languages do not have built-in cryptographic libraries. I'll leave the issue open and perhaps I'll add some specific rules for OpenSSL (e.g., https://linux.die.net/man/3/md5_init) in the future.

Thank you for the suggestion!

firmianay commented 2 years ago

Thanks for the explanation, looking forward to more rule updates~