Update warning message for rule S305 to address insecure block cipher mode use by mnixry · Pull Request #10602 · astral-sh/ruff

mnixry · 2024-03-26T08:29:23Z

Summary

This PR updates the warning message for rule S305 to accurately reflect the security concern over using ECB mode in block ciphers, which is considered insecure compared to other modes like CBC or CTR. The previous message incorrectly mentioned AES as a block cipher mode, which has been corrected to avoid confusion.

Ref:
https://github.com/PyCQA/bandit/blob/c85576d903c213859634f4fbcb6304042442e62a/bandit/blacklists/calls.py#L99-L102

ruff/crates/ruff_linter/src/rules/flake8_bandit/rules/suspicious_function_call.rs

Lines 187 to 216 in 825fd7c

    
           /// ## What it does 
        
           /// Checks for uses of weak or broken cryptographic cipher modes. 
        
           /// 
        
           /// ## Why is this bad? 
        
           /// Weak or broken cryptographic ciphers may be susceptible to attacks that 
        
           /// allow an attacker to decrypt ciphertext without knowing the key or 
        
           /// otherwise compromise the security of the cipher, such as forgeries. 
        
           /// 
        
           /// Use strong, modern cryptographic ciphers instead of weak or broken ones. 
        
           /// 
        
           /// ## Example 
        
           /// ```python 
        
           /// from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes 
        
           /// 
        
           /// algorithm = algorithms.ARC4(key) 
        
           /// cipher = Cipher(algorithm, mode=modes.ECB(iv)) 
        
           /// encryptor = cipher.encryptor() 
        
           /// ``` 
        
           /// 
        
           /// Use instead: 
        
           /// ```python 
        
           /// from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes 
        
           /// 
        
           /// algorithm = algorithms.ARC4(key) 
        
           /// cipher = Cipher(algorithm, mode=modes.CTR(iv)) 
        
           /// encryptor = cipher.encryptor() 
        
           /// ``` 
        
           /// 
        
           /// ## References 
        
           /// - [Common Weakness Enumeration: CWE-327](https://cwe.mitre.org/data/definitions/327.html)

Test Plan

No testing required as the change is limited to a minor change of warning message update.

github-actions · 2024-03-26T08:44:27Z

`ruff-ecosystem` results

Linter (stable)

✅ ecosystem check detected no linter changes.

Linter (preview)

✅ ecosystem check detected no linter changes.

charliermarsh

Thanks, this looks right to me!

mnixry added 2 commits March 26, 2024 16:11

Update warning message for bandit S305 rule

f32565b

Update suspicious_function_call.rs

5a7e438

charliermarsh approved these changes Mar 28, 2024

View reviewed changes

charliermarsh added the documentation Improvements or additions to documentation label Mar 28, 2024

charliermarsh merged commit cce25ec into astral-sh:main Mar 28, 2024

BrewTestBot mentioned this pull request Apr 1, 2024

ruff 0.3.5 Homebrew/homebrew-core#167712

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update warning message for rule S305 to address insecure block cipher mode use#10602

Update warning message for rule S305 to address insecure block cipher mode use#10602
charliermarsh merged 2 commits intoastral-sh:mainfrom
mnixry:patch-1

mnixry commented Mar 26, 2024

Uh oh!

github-actions bot commented Mar 26, 2024

Uh oh!

charliermarsh left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	/// ## What it does
	/// Checks for uses of weak or broken cryptographic cipher modes.
	///
	/// ## Why is this bad?
	/// Weak or broken cryptographic ciphers may be susceptible to attacks that
	/// allow an attacker to decrypt ciphertext without knowing the key or
	/// otherwise compromise the security of the cipher, such as forgeries.
	///
	/// Use strong, modern cryptographic ciphers instead of weak or broken ones.
	///
	/// ## Example
	/// ```python
	/// from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
	///
	/// algorithm = algorithms.ARC4(key)
	/// cipher = Cipher(algorithm, mode=modes.ECB(iv))
	/// encryptor = cipher.encryptor()
	/// ```
	///
	/// Use instead:
	/// ```python
	/// from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
	///
	/// algorithm = algorithms.ARC4(key)
	/// cipher = Cipher(algorithm, mode=modes.CTR(iv))
	/// encryptor = cipher.encryptor()
	/// ```
	///
	/// ## References
	/// - [Common Weakness Enumeration: CWE-327](https://cwe.mitre.org/data/definitions/327.html)

Conversation

mnixry commented Mar 26, 2024

Summary

Test Plan

Uh oh!

github-actions bot commented Mar 26, 2024

ruff-ecosystem results

Linter (stable)

Linter (preview)

Uh oh!

charliermarsh left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`ruff-ecosystem` results