Review

Detector:	Jadet
Target:	project ' chensun ' version cf23b99
Misuse:	misuse ' 2 '
Tags:

Misuse Details

Details about the known misuse from the MUBench dataset.

Description:	Uses a non-random key in CBC mode.
Fix Description:
Violation Types:	missing/condition/value_or_state
In File:	server/generateChecksumPostsAndReplies.java
In Method:	main(String[])
Code with Misuse:	class generateChecksumPostsAndReplies { /** * @param args / public static void main(String[] args) throws Exception{ /make decoder*/ DESKeySpec keySpec = new DESKeySpec(CryptoUtil.decode("92LlYoVU1hU=")); SecretKeyFactory factory = SecretKeyFactory.getInstance("DES"); SecretKey key = factory.generateSecret(keySpec); byte[] iv = CryptoUtil.decode(decAndCheck.substring(0, 12)); Cipher c = Cipher.getInstance("DES/CBC/PKCS5Padding"); IvParameterSpec ivSpec = new IvParameterSpec(iv); c.init(Cipher.DECRYPT_MODE, key, ivSpec); byte[] content = c.doFinal(CryptoUtil.decode(decAndCheck.substring(12))); System.out.println(new String(content, "UTF8")); byte[] checksum = Hash.generateChecksum(content); System.out.println("\"" + CryptoUtil.encode(checksum) + "\""); } }
Code with Pattern(s):	public class DES { public void encrypt(String strDataToEncrypt) { try { KeyGenerator keyGen = KeyGenerator.getInstance("DES"); SecretKey secretKey = keyGen.generateKey(); Cipher desCipher = Cipher.getInstance("DES/CBC/NoPadding"); desCipher.init(Cipher.ENCRYPT_MODE,secretKey); byte[] byteDataToEncrypt = strDataToEncrypt.getBytes(); byte[] byteCipherText = desCipher.doFinal(byteDataToEncrypt); } catch (NoSuchAlgorithmException noSuchAlgo) { } catch (NoSuchPaddingException noSuchPad) { } catch (InvalidKeyException invalidKey) { } catch (BadPaddingException badPadding) { } catch (IllegalBlockSizeException illegalBlockSize) { } } }

Potential Hits

Findings of the detector that identify an anomaly in the same file and method as the known misuse.

Hit	Rank	Confidence	Defect Indicator	Missing Properties	Pattern Support	Present Properties
?	0	0.98	26.24	RETVAL: Cipher.getInstance (String) : Cipher < EXC(InvalidKeyException): Cipher.init (int, Key) : void @ (0) RETVAL: KeyGenerator.generateKey () : SecretKey < EXC(InvalidKeyException): Cipher.init (int, Key) : void @ (2) RETVAL: KeyGenerator.generateKey () : SecretKey < Cipher.init (int, Key) : void @ (2) Cipher.init (int, Key) : void @ (0) < Cipher.doFinal (byte[]) : byte[] @ (0) Cipher.init (int, Key) : void @ (0) < EXC(BadPaddingException): Cipher.doFinal (byte[]) : byte[] @ (0) RETVAL: Cipher.getInstance (String) : Cipher < Cipher.init (int, Key) : void @ (0) RETVAL: KeyGenerator.getInstance (String) : KeyGenerator < KeyGenerator.generateKey () : SecretKey @ (0) Cipher.init (int, Key) : void @ (0) < EXC(IllegalBlockSizeException): Cipher.doFinal (byte[]) : byte[] @ (0)	50	RETVAL: Cipher.getInstance (String) : Cipher < EXC(IllegalBlockSizeException): Cipher.doFinal (byte[]) : byte[] @ (0) RETVAL: Cipher.getInstance (String) : Cipher < Cipher.doFinal (byte[]) : byte[] @ (0) RETVAL: Cipher.getInstance (String) : Cipher < EXC(BadPaddingException): Cipher.doFinal (byte[]) : byte[] @ (0)