SONARJAVA-6438: S4790 suppress weak hash algorithms on file-sourced data

.agents/RIS_PREPROCESSING.md

@@ -15,7 +15,6 @@ This analysis is based on direct inspection of the following source files:
 
 **Abstract Base Classes:**
 - `java-checks/src/main/java/org/sonar/java/checks/AbstractForLoopRule.java`
-- `java-checks/src/main/java/org/sonar/java/checks/AbstractHashAlgorithmChecker.java`
 - `java-checks/src/main/java/org/sonar/java/checks/regex/AbstractRegexCheck.java`
 - `java-checks-common/src/main/java/org/sonar/java/checks/methods/AbstractMethodDetection.java`
 
@@ -70,7 +69,6 @@ Based on file listings and @Rule annotation searches, the main java-checks modul
    - `AbstractRegexCheck` for regex validation rules
    - `AbstractMethodDetection` for method invocation-based rules
    - `AbstractForLoopRule` for for-loop analysis rules
-   - `AbstractHashAlgorithmChecker` for cryptography rules
 
 3. **Module organization:**
    - Core rules in `java-checks`

its/ruling/src/test/resources/expected/sonar-server/java-S4790.json

@@ -1,7 +1,4 @@
 {
-"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/batch/BatchIndex.java": [
-62
-],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/computation/task/projectanalysis/step/PersistFileSourcesStep.java": [
 135
 ],

java-checks-test-sources/default/src/main/java/checks/security/DataHashingCheckSample.java

@@ -156,11 +156,144 @@ class SpringDigestUtils {
 
   void digestUtils() throws IOException {
     org.springframework.util.DigestUtils.appendMd5DigestAsHex(new byte[10], new StringBuilder()); // Noncompliant {{Make sure this weak hash algorithm is not used in a sensitive context here.}}
-    org.springframework.util.DigestUtils.appendMd5DigestAsHex(new FileInputStream(""), new StringBuilder()); // Noncompliant
+    org.springframework.util.DigestUtils.appendMd5DigestAsHex(new FileInputStream(""), new StringBuilder()); // Compliant, file content
     org.springframework.util.DigestUtils.md5Digest(new byte[10]); // Noncompliant
-    org.springframework.util.DigestUtils.md5Digest(new FileInputStream("")); // Noncompliant {{Make sure this weak hash algorithm is not used in a sensitive context here.}}
+    org.springframework.util.DigestUtils.md5Digest(new FileInputStream("")); // Compliant, file content
     org.springframework.util.DigestUtils.md5DigestAsHex(new byte[10]); // Noncompliant
-    org.springframework.util.DigestUtils.md5DigestAsHex(new FileInputStream("")); // Noncompliant
+    org.springframework.util.DigestUtils.md5DigestAsHex(new FileInputStream("")); // Compliant, file content
   }
 
 }
+
+class FileSourcedData {
+
+  void oneShot(java.nio.file.Path path, java.io.File file) throws IOException {
+    DigestUtils.md5Hex(java.nio.file.Files.newInputStream(path));
+    DigestUtils.sha1Hex(java.nio.file.Files.readAllBytes(path));
+    DigestUtils.md5Hex(java.nio.file.Files.readString(path));
+    DigestUtils.md5Hex(new java.io.BufferedInputStream(new FileInputStream(file)));
+    DigestUtils.md5Hex(org.apache.commons.io.IOUtils.toByteArray(new FileInputStream(file)));
+    DigestUtils.md5Hex(org.apache.commons.io.IOUtils.toByteArray(new java.io.FileReader(file)));
+    DigestUtils.md5Hex(org.apache.commons.io.FileUtils.readFileToByteArray(file));
+    DigestUtils.md5Hex(java.nio.file.Files.newInputStream(path).readAllBytes());
+    DigestUtils.md5Hex(com.google.common.io.Files.asByteSource(file).read());
+    DigestUtils.md5Hex(java.nio.channels.Channels.newInputStream(java.nio.channels.FileChannel.open(path)));
+  }
+
+  void uploads(org.springframework.web.multipart.MultipartFile multipartFile, javax.servlet.http.Part javaxPart, jakarta.servlet.http.Part jakartaPart) throws IOException {
+    DigestUtils.md5Hex(multipartFile.getBytes()); // Noncompliant
+    DigestUtils.md5Hex(multipartFile.getInputStream()); // Noncompliant
+    DigestUtils.sha1Hex(javaxPart.getInputStream()); // Noncompliant
+    DigestUtils.sha1Hex(jakartaPart.getInputStream()); // Noncompliant
+  }
+
+  void variables(java.nio.file.Path path) throws IOException {
+    try (java.io.InputStream resource = java.nio.file.Files.newInputStream(path)) {
+      DigestUtils.sha1Hex(resource);
+    }
+    byte[] content = java.nio.file.Files.readAllBytes(path);
+    DigestUtils.md5Hex(content);
+  }
+
+  void chained(java.nio.file.Path path) throws IOException, NoSuchAlgorithmException {
+    MessageDigest.getInstance("MD5").digest(java.nio.file.Files.readAllBytes(path));
+    MessageDigest.getInstance("SHA-1").digest(java.nio.file.Files.readAllBytes(path));
+    DigestUtils.getMd5Digest().digest(java.nio.file.Files.readAllBytes(path));
+    com.google.common.hash.Hashing.md5().hashBytes(java.nio.file.Files.readAllBytes(path));
+  }
+
+  void streaming(java.nio.file.Path path) throws IOException, NoSuchAlgorithmException {
+    MessageDigest md = MessageDigest.getInstance("MD5");
+    try (java.io.InputStream is = new java.security.DigestInputStream(java.nio.file.Files.newInputStream(path), md)) {
+      is.transferTo(java.io.OutputStream.nullOutputStream());
+    }
+    md.digest();
+  }
+
+  void updates(java.nio.file.Path first, java.nio.file.Path second) throws IOException, NoSuchAlgorithmException {
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    md.update(java.nio.file.Files.readAllBytes(first));
+    md.update(java.nio.file.Files.readAllBytes(second));
+    md.digest();
+  }
+
+  void mac(java.nio.file.Path path, javax.crypto.SecretKey key) throws IOException, java.security.GeneralSecurityException {
+    javax.crypto.Mac mac = javax.crypto.Mac.getInstance("HmacSHA1");
+    mac.init(key);
+    mac.doFinal(java.nio.file.Files.readAllBytes(path));
+  }
+
+  void guavaByteSource(java.io.File file) throws IOException {
+    com.google.common.io.Files.asByteSource(file).hash(com.google.common.hash.Hashing.md5());
+  }
+}
+
+class NotProvenToBeFileData {
+
+  private final MessageDigest fieldDigest = DigestUtils.getMd5Digest(); // Noncompliant
+
+  static byte[] concat(byte[] first, byte[] second) {
+    return first;
+  }
+
+  void consume(MessageDigest digest) {
+  }
+
+  void mixedData(java.nio.file.Path path, String password) throws IOException, NoSuchAlgorithmException {
+    DigestUtils.md5Hex(concat(java.nio.file.Files.readAllBytes(path), password.getBytes())); // Noncompliant
+    MessageDigest md = MessageDigest.getInstance("MD5"); // Noncompliant
+    md.update(java.nio.file.Files.readAllBytes(path));
+    md.update(password.getBytes());
+    md.digest();
+  }
+
+  void escapingDigest(java.nio.file.Path path) throws IOException, NoSuchAlgorithmException {
+    MessageDigest md = MessageDigest.getInstance("MD5"); // Noncompliant
+    md.update(java.nio.file.Files.readAllBytes(path));
+    consume(md);
+  }
+
+  void neverFed() throws NoSuchAlgorithmException {
+    MessageDigest md = MessageDigest.getInstance("MD5"); // Noncompliant
+    md.digest();
+  }
+
+  void notFileData(byte[] bytes, java.io.InputStream stream, java.net.Socket socket) throws IOException {
+    DigestUtils.md5Hex(bytes); // Noncompliant
+    DigestUtils.md5Hex(new java.io.ByteArrayInputStream(bytes)); // Noncompliant
+    DigestUtils.md5Hex(new java.io.BufferedInputStream(stream)); // Noncompliant
+    DigestUtils.md5Hex(org.apache.commons.io.IOUtils.toByteArray(socket.getInputStream())); // Noncompliant
+    DigestUtils.md5Hex(java.nio.channels.Channels.newInputStream(java.nio.channels.Channels.newChannel(stream))); // Noncompliant
+    com.google.common.hash.Hashing.md5().hashBytes(bytes); // Noncompliant
+    com.google.common.io.ByteSource.wrap(bytes).hash(com.google.common.hash.Hashing.md5()); // Noncompliant
+  }
+
+  void arrayOverwritten(java.nio.file.Path path, byte[] secret) throws IOException {
+    byte[] data = java.nio.file.Files.readAllBytes(path);
+    System.arraycopy(secret, 0, data, 0, secret.length);
+    DigestUtils.md5Hex(data); // Noncompliant
+  }
+
+  void arrayXored(java.nio.file.Path path, byte[] key) throws IOException {
+    byte[] data = java.nio.file.Files.readAllBytes(path);
+    data[0] ^= key[0];
+    DigestUtils.md5Hex(data); // Noncompliant
+  }
+
+  void arrayMixed(java.nio.file.Path path, byte[] secret) throws IOException {
+    byte[] data = java.nio.file.Files.readAllBytes(path);
+    concat(data, secret);
+    DigestUtils.md5Hex(data); // Noncompliant
+  }
+
+  void reassigned(java.nio.file.Path path, byte[] bytes) throws IOException {
+    java.io.InputStream stream = java.nio.file.Files.newInputStream(path);
+    stream = new java.io.ByteArrayInputStream(bytes);
+    DigestUtils.md5Hex(stream); // Noncompliant
+  }
+
+  void otherAlgorithms(java.nio.file.Path path) throws IOException, NoSuchAlgorithmException {
+    DigestUtils.md2Hex(java.nio.file.Files.readAllBytes(path)); // Noncompliant
+    MessageDigest.getInstance("MD2").digest(java.nio.file.Files.readAllBytes(path)); // Noncompliant
+  }
+}