Java


JAVA.CRYPTO.BASE64 : Unsafe Base64 Encoding (Java)

要旨

Base64 encoding is used. This encoding is relatively easy to decode and should not be used with sensitive data.

プロパティ

クラス名 Unsafe Base64 Encoding (Java)
日本語クラス名 Unsafe Base64 Encoding (Java)
クラス分類 セキュリティ (security)
ニーモニック JAVA.CRYPTO.BASE64
カテゴリー
CWE CWE:327 Use of a Broken or Risky Cryptographic Algorithm
CERT-Java CERT-Java:DRD18 Do not use the default behavior in a cryptographic library if it does not use recommended practices
  CERT-Java:MSC02-J Generate strong random numbers
OWASP-2017 OWASP-2017:A2 Broken authentication
OWASP-2021 OWASP-2021:A7 Identification and authorization failures
対応言語 Java で利用可能です。
有効/無効設定 Checks for this warning class are disabled by default, and require pedantic Java analysis mode which is also disabled by default. To enable the checks, make the following changes to the project configuration file.
JAVA_ANALYSIS_PEDANTIC_MODE = Yes
WARNING_FILTER += allow class="Unsafe Base64 Encoding (Java)"

import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;

import javax.crypto.Cipher;
import javax.crypto.NoSuchPaddingException;

public class BrokenAlgorithms {

  public static void main(String[] args) throws NoSuchAlgorithmException, NoSuchPaddingException, NoSuchProviderException {
      Cipher.getInstance("DES");                   /* Warnings of two classes issued here:
                                                    * - Cryptographic Algorithm with Risky Default Cipher (Java)
                                                    * - Risky Cryptographic Algorithm (Java)
                                                    */
      Cipher.getInstance("MyComplexAlgo", "myProvider");
      Cipher.getInstance("MD5", "myProvider");     // Weak Hash Algorithm (Java) warning issued here

      String mypassword= "Hello World !";
      Base64.decodeBase64(mypassword.getBytes()); // Unsafe Base64 Encoding (Java) warning issued here

      Cipher.getInstance("AES/ECB/NoPadding");    // Cryptographic Algorithm with Weak Cipher (Java) warning issued here
      Cipher.getInstance("AES");                  // Cryptographic Algorithm with Risky Default Cipher (Java) warning issued here
  }
}

解決法

Use a safer cryptography algorithm.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。