We ran SonarQube with Java to scan the following code snippet:
package com.minimals.Cipher.stringCaseTransform;
import java.security.NoSuchAlgorithmException;
import java.util.Locale;
import javax.crypto.Cipher;
import javax.crypto.NoSuchPaddingException;
public class CipherExample {
public static void main(String[] args)
throws NoSuchAlgorithmException, NoSuchPaddingException {
Cipher c = Cipher.getInstance("des".toUpperCase(Locale.ENGLISH));
System.out.println(c.toString());
}
}
We scanned the source Java file using the docker. The command we used is:
sonar-scanner \
-Dsonar.projectKey={PROJECT NAME} \
-Dsonar.sources=. \
-Dsonar.host.url=http://localhost:9000 \
-Dsonar.login={PROJECT KEY}
However, while it is possible to statically compute the value to be passed to Cipher.getInstance(), SonarQube does not report it.
Of course, SonarQube reports the issue when DES or des are used directly, such as:
Cipher c = Cipher.getInstance("DES");
and
Cipher c = Cipher.getInstance("des");
in a similar source file.
Which is why I think it is a false negative.
Additional Details
Language: Java
Rule: java:S5547, java:S5542
Product Details:
SonarQube Community Edition Version - 9.6.1
Sonar Scanner Version - 4.7
Java Version - Java 11.0.14.1 Eclipse Adoptium (64-bit)
Operating System - MacOS Monterey version 12.6
