Merge pull request github#20666 from owen-mc/go/promote-weak-crypto-algorithm

Go: promote `go/weak-crypto-algorithm`

Author: owen-mc

go/ql/integration-tests/query-suite/go-code-scanning.qls.expected

@@ -18,7 +18,9 @@ ql/go/ql/src/Security/CWE-295/DisabledCertificateCheck.ql
 ql/go/ql/src/Security/CWE-312/CleartextLogging.ql
 ql/go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
 ql/go/ql/src/Security/CWE-326/InsufficientKeySize.ql
+ql/go/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql
 ql/go/ql/src/Security/CWE-327/InsecureTLS.ql
+ql/go/ql/src/Security/CWE-327/WeakSensitiveDataHashing.ql
 ql/go/ql/src/Security/CWE-338/InsecureRandomness.ql
 ql/go/ql/src/Security/CWE-347/MissingJwtSignatureCheck.ql
 ql/go/ql/src/Security/CWE-352/ConstantOauth2State.ql

go/ql/integration-tests/query-suite/go-security-and-quality.qls.expected

@@ -41,7 +41,9 @@ ql/go/ql/src/Security/CWE-295/DisabledCertificateCheck.ql
 ql/go/ql/src/Security/CWE-312/CleartextLogging.ql
 ql/go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
 ql/go/ql/src/Security/CWE-326/InsufficientKeySize.ql
+ql/go/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql
 ql/go/ql/src/Security/CWE-327/InsecureTLS.ql
+ql/go/ql/src/Security/CWE-327/WeakSensitiveDataHashing.ql
 ql/go/ql/src/Security/CWE-338/InsecureRandomness.ql
 ql/go/ql/src/Security/CWE-347/MissingJwtSignatureCheck.ql
 ql/go/ql/src/Security/CWE-352/ConstantOauth2State.ql

go/ql/integration-tests/query-suite/go-security-extended.qls.expected

@@ -19,7 +19,9 @@ ql/go/ql/src/Security/CWE-295/DisabledCertificateCheck.ql
 ql/go/ql/src/Security/CWE-312/CleartextLogging.ql
 ql/go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
 ql/go/ql/src/Security/CWE-326/InsufficientKeySize.ql
+ql/go/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql
 ql/go/ql/src/Security/CWE-327/InsecureTLS.ql
+ql/go/ql/src/Security/CWE-327/WeakSensitiveDataHashing.ql
 ql/go/ql/src/Security/CWE-338/InsecureRandomness.ql
 ql/go/ql/src/Security/CWE-347/MissingJwtSignatureCheck.ql
 ql/go/ql/src/Security/CWE-352/ConstantOauth2State.ql

go/ql/integration-tests/query-suite/not_included_in_qls.expected

@@ -14,7 +14,6 @@ ql/go/ql/src/experimental/CWE-203/Timing.ql
 ql/go/ql/src/experimental/CWE-285/PamAuthBypass.ql
 ql/go/ql/src/experimental/CWE-287/ImproperLdapAuth.ql
 ql/go/ql/src/experimental/CWE-321-V2/HardCodedKeys.ql
-ql/go/ql/src/experimental/CWE-327/WeakCryptoAlgorithm.ql
 ql/go/ql/src/experimental/CWE-369/DivideByZero.ql
 ql/go/ql/src/experimental/CWE-400/DatabaseCallInLoop.ql
 ql/go/ql/src/experimental/CWE-522-DecompressionBombs/DecompressionBombs.ql

go/ql/lib/go.qll

@@ -33,6 +33,7 @@ import semmle.go.frameworks.AwsLambda
 import semmle.go.frameworks.Beego
 import semmle.go.frameworks.BeegoOrm
 import semmle.go.frameworks.Bun
+import semmle.go.frameworks.CryptoLibraries
 import semmle.go.frameworks.RsCors
 import semmle.go.frameworks.Couchbase
 import semmle.go.frameworks.Echo

go/ql/lib/qlpack.yml

@@ -6,6 +6,7 @@ extractor: go
 library: true
 upgrades: upgrades
 dependencies:
+  codeql/concepts: ${workspace}
   codeql/dataflow: ${workspace}
   codeql/mad: ${workspace}
   codeql/threat-models: ${workspace}

go/ql/lib/semmle/go/Concepts.qll

@@ -8,6 +8,10 @@ import go
 import semmle.go.dataflow.FunctionInputsAndOutputs
 import semmle.go.concepts.HTTP
 import semmle.go.concepts.GeneratedFile
+private import codeql.concepts.ConceptsShared
+private import semmle.go.dataflow.internal.DataFlowImplSpecific
+
+private module ConceptsShared = ConceptsMake<Location, GoDataFlow>;
 
 /**
  * A data-flow node that executes an operating system command,
@@ -505,3 +509,98 @@ module UnmarshalingFunction {
     abstract string getFormat();
   }
 }
+
+/**
+ * Provides models for cryptographic things.
+ */
+module Cryptography {
+  private import ConceptsShared::Cryptography as SC
+
+  /**
+   * A data-flow node that is an application of a cryptographic algorithm. For example,
+   * encryption, decryption, signature-validation.
+   *
+   * Extend this class to refine existing API models. If you want to model new APIs,
+   * extend `CryptographicOperation::Range` instead.
+   */
+  class CryptographicOperation extends SC::CryptographicOperation { }
+
+  class EncryptionAlgorithm = SC::EncryptionAlgorithm;
+
+  class HashingAlgorithm = SC::HashingAlgorithm;
+
+  class PasswordHashingAlgorithm = SC::PasswordHashingAlgorithm;
+
+  module CryptographicOperation = SC::CryptographicOperation;
+
+  class BlockMode = SC::BlockMode;
+
+  class CryptographicAlgorithm = SC::CryptographicAlgorithm;
+
+  /** A data flow node that initializes a hash algorithm. */
+  abstract class HashAlgorithmInit extends DataFlow::Node {
+    /** Gets the hash algorithm being initialized. */
+    abstract HashingAlgorithm getAlgorithm();
+  }
+
+  /** A data flow node that is an application of a hash algorithm. */
+  abstract class HashOperation extends CryptographicOperation::Range {
+    override BlockMode getBlockMode() { none() }
+  }
+
+  /** A data flow node that initializes an encryption algorithm. */
+  abstract class EncryptionAlgorithmInit extends DataFlow::Node {
+    /** Gets the encryption algorithm being initialized. */
+    abstract EncryptionAlgorithm getAlgorithm();
+  }
+
+  /**
+   * A data flow node that initializes a block cipher mode of operation, and
+   * may also propagate taint for encryption algorithms.
+   */
+  abstract class BlockModeInit extends DataFlow::CallNode {
+    /** Gets the block cipher mode of operation being initialized. */
+    abstract BlockMode getMode();
+
+    /** Gets a step propagating the encryption algorithm through this call. */
+    abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
+  }
+
+  /**
+   * A data flow node that is an application of an encryption algorithm, where
+   * the encryption algorithm and the block cipher mode of operation (if there
+   * is one) have been initialized separately.
+   */
+  abstract class EncryptionOperation extends CryptographicOperation::Range {
+    DataFlow::Node encryptionFlowTarget;
+    DataFlow::Node inputNode;
+
+    override DataFlow::Node getInitialization() {
+      EncryptionFlow::flow(result, encryptionFlowTarget)
+    }
+
+    override EncryptionAlgorithm getAlgorithm() {
+      result = this.getInitialization().(EncryptionAlgorithmInit).getAlgorithm()
+    }
+
+    override DataFlow::Node getAnInput() { result = inputNode }
+
+    override BlockMode getBlockMode() {
+      result = this.getInitialization().(BlockModeInit).getMode()
+    }
+  }
+
+  /**
+   * An `EncryptionOperation` which is a method call where the encryption
+   * algorithm and block cipher mode of operation (if there is one) flow to the
+   * receiver and the input is an argument.
+   */
+  abstract class EncryptionMethodCall extends EncryptionOperation instanceof DataFlow::CallNode {
+    int inputArg;
+
+    EncryptionMethodCall() {
+      encryptionFlowTarget = super.getReceiver() and
+      inputNode = super.getArgument(inputArg)
+    }
+  }
+}