Add CodeQL Quantum models and queries (Java, C++) to experimental #19469
Conversation
Concepts for elliptic curves and misc. updates.
Move language-agnostic model to shared library
…ryption operations.
…nwrap and doFinal calls. Corrected pathing for init tracing to detect what mode is being set along a path. Added support for tracing the init operation mode argument to source. Since this involved creating an Operation Mode, changes were also made to make cipher block modes (CBC) more explicit (previously just called mode, but now that term is used for various purposes).
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
|
Note for review: the changes not targeting |
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
…/codeql into quantum-experimental
| @@ -0,0 +1,7 @@ | |||
| name: codeql/experimental | |||
There was a problem hiding this comment.
If a new qlpack is added, I think it needs to be added to the list here. Do you have access to the internal repo?
There was a problem hiding this comment.
Opened a PR: https://github.com/github/semmle-code/pull/53077.
This pull request introduces libraries and queries for inventorying and analyzing cryptography through a shared language-independent model library, language-specific implementations, and library-specific models.
There is currently modelling for the Java Cryptography Architecture (JCA) and OpenSSL (C++), with DGML-based inventory graph output for both currently supported languages. Our Java implementation further provides a set of analysis queries and inventory subset ("slice") output queries.