We ran SonarQube with Java to scan the following code snippet:
package com.minimals.Cipher.baseCaseInterProc;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Cipher;
import javax.crypto.NoSuchPaddingException;
public class CipherExample {
private String cipherName = "AES/GCM/NoPadding";
public CipherExample methodA() {
cipherName = "AES/GCM/NoPadding";
return this;
}
public CipherExample methodB() {
cipherName = "DES";
return this;
}
public String getCipherName(){
return cipherName;
}
public static void main(String[] args) throws NoSuchAlgorithmException, NoSuchPaddingException {
Cipher c = Cipher.getInstance(new CipherExample().methodA().methodB().getCipherName());
System.out.println(c.getAlgorithm());
}
}
We scanned the source Java file using the docker. The command we used is:
sonar-scanner \
-Dsonar.projectKey={PROJECT NAME} \
-Dsonar.sources=. \
-Dsonar.host.url=http://localhost:9000 \
-Dsonar.login={PROJECT KEY}
However, while it is possible to statically compute the value to be passed to Cipher.getInstance(), SonarQube does not report it.
Of course, SonarQube reports the issue when DES is used directly, such as:
Cipher c = Cipher.getInstance("DES");
in a similar source file.
Which is why I think it is a false negative.
Additional Details
Language: Java
Rule: java:S5547, java:S5542
Product Details:
SonarQube Community Edition Version - 9.6.1
Sonar Scanner Version - 4.7
Java Version - Java 11.0.14.1 Eclipse Adoptium (64-bit)
Operating System - MacOS Monterey version 12.6