github / github/codeql

CWE(s) in Kotlin not being detected by java-kotlin queries?

Aperta
#19,517 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
question
Lingua principale
CodeQL
Stelle
10.1k
Fork
2.1k
Merge medio
2g 15h
PR unite (30g)
141

Descrizione

Hi!

I recently did a test with CodeQL on a new Kotlin project, and I included [CWE-1204](https://codeql.github.com/codeql-query-help/java/java-static-initialization-vector/) to get a detection.

I copied the example from documentation and [test case](https://github.com/github/codeql/blob/60cc63f4d4f6827ec68584b8ec0763ed4043189e/java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.java#L15). I then used IntelliJ IDEA to convert it from Java to Kotlin.

```kotlin
@Throws(Exception::class)
fun encryptWithZeroStaticIvByteArray(key: ByteArray?, plaintext: ByteArray?): ByteArray {
val iv = ByteArray(16) // $Source

val ivSpec = GCMParameterSpec(128, iv)
val keySpec = SecretKeySpec(key, "AES")

val cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING")
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec) // $Alert
cipher.update(plaintext)
return cipher.doFinal()
}
```

I got no detections, and assumed it was an issue with Actions setup, after debugging I decided to test out [CWE-117](https://codeql.github.com/codeql-query-help/java/java-log-injection/) which I've heard works on Kotlin. After I ran the CI/CD setup it was detected.

I was recommended to try out example from [CWE-1204](https://codeql.github.com/codeql-query-help/java/java-static-initialization-vector/) using a new Java project. After running the CI/CD setup, it was detected.

I spent some time trying to figure out why, decompiling the code, looking at logs. I then looked at sarif file, and I found following rule:

```json
"ruleId": "java/telemetry/unsupported-external-api",
"value": 4,
"message": { "text": "kotlin.ByteArray#ByteArray(int)" }
```

Questions:
* Is there a known list which queries have been tested and works with Kotlin?
* or a list of queries that is not working with Kotlin?
* Is there anything I can do while waiting for queries to be fully compatible with Kotlin?__

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Inizia dalla guida della query CWE-1204 e dal test collegato in java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.java, quindi confronta quel caso Java con l'esempio Kotlin nell'issue. Ispeziona la voce SARIF per java/telemetry/unsupported-external-api e determina se la gestione di Kotlin ByteArray è coperta. Il lavoro è completato quando è stata stabilita la lacuna di compatibilità e identificata la modifica necessaria alla query o alla documentazione.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
java, kotlin
Ambito
security
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Da chiarire
Idoneità per principianti
25/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.