codeql/powershell/ql/test/query-tests/security/cwe-327/WeakHmac/test.ps1 at 424ba6a30b0c1f8d8b18d745e22e87bc9b25a561 · microsoft/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
# ===================================================================
# ========== TRUE POSITIVES (should trigger alert) ==================
# ===================================================================

# --- Case 1: HMACMD5 via New-Object ---
$hmac = New-Object System.Security.Cryptography.HMACMD5 # BAD

# --- Case 2: HMACSHA1 via New-Object ---
$hmac = New-Object System.Security.Cryptography.HMACSHA1 # BAD

# --- Case 3: HMACMD5 via static Create ---
$hmac = [System.Security.Cryptography.HMACMD5]::Create() # BAD

# --- Case 4: HMACSHA1 via ::new() ---
$hmac = [System.Security.Cryptography.HMACSHA1]::new() # BAD

# ===================================================================
# ========== TRUE NEGATIVES (should NOT trigger alert) ==============
# ===================================================================

# --- Safe: HMACSHA256 ---
$hmac = New-Object System.Security.Cryptography.HMACSHA256 # GOOD

# --- Safe: HMACSHA384 ---
$hmac = [System.Security.Cryptography.HMACSHA384]::new() # GOOD

# --- Safe: HMACSHA512 ---
$hmac = [System.Security.Cryptography.HMACSHA512]::Create() # GOOD