Uploaded image for project: 'SonarKotlin'
  1. SonarKotlin
  2. SONARKT-50

Rule S6288: Authorizing non-authenticated users to use keys in the Android KeyStore is security-sensitive

    XMLWordPrintable

    Details

    • Type: New Feature
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.1
    • Component/s: None
    • Labels:

      Description

      New rule to implement

      s6288 should raise an issue on KeyGenParameterSpec.Builder when the call to setUserAuthenticationRequired set to true is missing or if setUserAuthenticationRequired is called but set to false:

      val keyGenerator: KeyGenerator = 
var builder: KeyGenParameterSpec = KeyGenParameterSpec.Builder("test_secret_key", KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT) // Noncompliant 
   .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
   .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
   .build()

      var builder: KeyGenParameterSpec = KeyGenParameterSpec.Builder("test_secret_key", KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT) // Noncompliant 
   .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
   .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
   .setUserAuthenticationRequired(false) // Noncompliant secondary location
   .build()

        Attachments

          Issue Links

          implements

          Security Hotspot Detection - RSPEC-6288 Authorizing non-authenticated users to use keys in the Android KeyStore is security-sensitive

          • Active

            Activity

              People

              Assignee:
              margarita.nedzelska Margarita Nedzelska
              Reporter:
              eric.therond Eric Therond (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Due:
                Created:
                Updated:
                Resolved: