C#

CSHARP.CRYPTO.BASE64 : Unsafe Base64 Encoding (C#)

要旨

Base64 encoding is used. This encoding is relatively easy to decode and should not be used with sensitive data.

プロパティ

クラス名 Unsafe Base64 Encoding (C#)
日本語クラス名 Unsafe Base64 Encoding (C#)
クラス分類 セキュリティ (security)
ニーモニック CSHARP.CRYPTO.BASE64
カテゴリー
CWE CWE:327 Use of a Broken or Risky Cryptographic Algorithm
OWASP-2017 OWASP-2017:A2 Broken authentication
OWASP-2021 OWASP-2021:A7 Identification and authorization failures
対応言語 C# で利用可能です。
有効/無効設定 Checks for this warning class are disabled by default, and require pedantic C# analysis mode which is also disabled by default. To enable the checks, make the following changes to the project configuration file. 
CSHARP_ANALYSIS_PEDANTIC_MODE = Yes
WARNING_FILTER += allow class="Unsafe Base64 Encoding (C#)"

例 

using System;
using System.Security.Cryptography;

namespace DocumentationExamples
{
    public class Cryptography
    {
        public static void Main(string[] args)
        {
            DES.Create();                         // Risky Cryptographic Field (C#) warning issued here 
            SHA256.Create();
            MD5.Create();                         // Weak Hash Algorithm (C#) warning issued here 

            string mypassword = "HELLO WORLD!";
            Convert.FromBase64String(mypassword); // Unsafe Base64 Encoding (C#) warning issued here 

            AesCryptoServiceProvider provider = new AesCryptoServiceProvider();
            provider.Mode = CipherMode.ECB;       // Cryptographic Algorithm with Weak Cipher (C#) warning issued here 
                                                  // - AesCryptoServiceProvider is a secure algorithm, but ECB is an unsafe cipher mode.

        }
    }
}

解決法

Use a safer cryptography algorithm.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。