Skip to content

Commit 4bda03f

Browse files
geoffw0geoffw0
committed
Rust: Make arithmetic operations a barrier for rust/hard-coded-cryptographic-value (including string concatenation).
1 parent 0c72a2b commit 4bda03f

3 files changed

Lines changed: 46 additions & 75 deletions

File tree

‎rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,4 +155,24 @@ module HardcodedCryptographicValue {
155155
)
156156
}
157157
}
158+
159+
/**
160+
* An arithmetic or bitwise operation that acts as a barrier.
161+
*
162+
* This prevents false positives where a hard-coded value is combined with
163+
* non-constant data through operations like `+`, `^`, or `+=`.
164+
*/
165+
private class ArithmeticOperationBarrier extends Barrier {
166+
ArithmeticOperationBarrier() {
167+
// binary operations (e.g. `a + b`, `a ^ b`)
168+
this.asExpr() instanceof BinaryArithmeticOperation
169+
or
170+
this.asExpr() instanceof BinaryBitwiseOperation
171+
or
172+
// compound assignments (e.g. `a += b`, `a ^= b`)
173+
this.asExpr() = any(AssignArithmeticOperation a | | a.getAnOperand())
174+
or
175+
this.asExpr() = any(AssignBitwiseOperation a | | a.getAnOperand())
176+
}
177+
}
158178
}

‎rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected‎

Lines changed: 19 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -15,43 +15,37 @@
1515
| test_heuristic.rs:64:20:64:27 | [0u8; 16] | test_heuristic.rs:64:20:64:27 | [0u8; 16] | test_heuristic.rs:64:19:64:27 | &... | This hard-coded value is used as $@. | test_heuristic.rs:64:19:64:27 | &... | a nonce |
1616
| test_heuristic.rs:65:31:65:38 | [0u8; 16] | test_heuristic.rs:65:31:65:38 | [0u8; 16] | test_heuristic.rs:65:30:65:38 | &... | This hard-coded value is used as $@. | test_heuristic.rs:65:30:65:38 | &... | a salt |
1717
| test_heuristic.rs:67:22:67:22 | 0 | test_heuristic.rs:67:22:67:22 | 0 | test_heuristic.rs:67:22:67:22 | 0 | This hard-coded value is used as $@. | test_heuristic.rs:67:22:67:22 | 0 | a salt |
18-
| test_heuristic.rs:69:32:69:32 | 1 | test_heuristic.rs:69:32:69:32 | 1 | test_heuristic.rs:69:22:69:32 | ... + ... | This hard-coded value is used as $@. | test_heuristic.rs:69:22:69:32 | ... + ... | a salt |
19-
| test_heuristic.rs:70:34:70:35 | 32 | test_heuristic.rs:70:34:70:35 | 32 | test_heuristic.rs:70:22:70:62 | ... ^ ... | This hard-coded value is used as $@. | test_heuristic.rs:70:22:70:62 | ... ^ ... | a salt |
20-
| test_heuristic.rs:70:52:70:61 | 0xFFFFFFFF | test_heuristic.rs:70:52:70:61 | 0xFFFFFFFF | test_heuristic.rs:70:22:70:62 | ... ^ ... | This hard-coded value is used as $@. | test_heuristic.rs:70:22:70:62 | ... ^ ... | a salt |
21-
| test_heuristic.rs:72:20:72:24 | "foo" | test_heuristic.rs:72:20:72:24 | "foo" | test_heuristic.rs:74:28:74:32 | &key1 | This hard-coded value is used as $@. | test_heuristic.rs:74:28:74:32 | &key1 | a password |
22-
| test_heuristic.rs:73:13:73:17 | "bar" | test_heuristic.rs:73:13:73:17 | "bar" | test_heuristic.rs:74:28:74:32 | &key1 | This hard-coded value is used as $@. | test_heuristic.rs:74:28:74:32 | &key1 | a password |
23-
| test_heuristic.rs:76:20:76:24 | "foo" | test_heuristic.rs:76:20:76:24 | "foo" | test_heuristic.rs:78:28:78:32 | &key2 | This hard-coded value is used as $@. | test_heuristic.rs:78:28:78:32 | &key2 | a password |
2418
edges
2519
| test_cipher.rs:18:9:18:14 | const1 [&ref] | test_cipher.rs:19:73:19:78 | const1 [&ref] | provenance | |
2620
| test_cipher.rs:18:28:18:36 | &... [&ref] | test_cipher.rs:18:9:18:14 | const1 [&ref] | provenance | |
2721
| test_cipher.rs:18:29:18:36 | [0u8; 16] | test_cipher.rs:18:28:18:36 | &... [&ref] | provenance | |
2822
| test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref] | test_cipher.rs:19:30:19:47 | ...::new | provenance | MaD:3 Sink:MaD:3 |
29-
| test_cipher.rs:19:73:19:78 | const1 [&ref] | test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref] | provenance | MaD:20 |
23+
| test_cipher.rs:19:73:19:78 | const1 [&ref] | test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref] | provenance | MaD:13 |
3024
| test_cipher.rs:25:9:25:14 | const4 [&ref] | test_cipher.rs:26:66:26:71 | const4 [&ref] | provenance | |
3125
| test_cipher.rs:25:28:25:36 | &... [&ref] | test_cipher.rs:25:9:25:14 | const4 [&ref] | provenance | |
3226
| test_cipher.rs:25:29:25:36 | [0u8; 16] | test_cipher.rs:25:28:25:36 | &... [&ref] | provenance | |
3327
| test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref] | test_cipher.rs:26:30:26:40 | ...::new | provenance | MaD:4 Sink:MaD:4 |
34-
| test_cipher.rs:26:66:26:71 | const4 [&ref] | test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref] | provenance | MaD:20 |
28+
| test_cipher.rs:26:66:26:71 | const4 [&ref] | test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref] | provenance | MaD:13 |
3529
| test_cipher.rs:29:9:29:14 | const5 [&ref] | test_cipher.rs:30:95:30:100 | const5 [&ref] | provenance | |
3630
| test_cipher.rs:29:28:29:36 | &... [&ref] | test_cipher.rs:29:9:29:14 | const5 [&ref] | provenance | |
3731
| test_cipher.rs:29:29:29:36 | [0u8; 16] | test_cipher.rs:29:28:29:36 | &... [&ref] | provenance | |
3832
| test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref] | test_cipher.rs:30:30:30:40 | ...::new | provenance | MaD:5 Sink:MaD:5 |
39-
| test_cipher.rs:30:95:30:100 | const5 [&ref] | test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref] | provenance | MaD:20 |
33+
| test_cipher.rs:30:95:30:100 | const5 [&ref] | test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref] | provenance | MaD:13 |
4034
| test_cipher.rs:37:9:37:14 | const7 | test_cipher.rs:38:74:38:79 | const7 | provenance | |
4135
| test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:37:9:37:14 | const7 | provenance | |
4236
| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | test_cipher.rs:38:30:38:47 | ...::new | provenance | MaD:3 Sink:MaD:3 |
43-
| test_cipher.rs:38:73:38:79 | &const7 [&ref] | test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | provenance | MaD:20 |
37+
| test_cipher.rs:38:73:38:79 | &const7 [&ref] | test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | provenance | MaD:13 |
4438
| test_cipher.rs:38:74:38:79 | const7 | test_cipher.rs:38:73:38:79 | &const7 [&ref] | provenance | |
4539
| test_cipher.rs:41:9:41:14 | const8 [&ref] | test_cipher.rs:42:73:42:78 | const8 [&ref] | provenance | |
4640
| test_cipher.rs:41:28:41:76 | &... [&ref] | test_cipher.rs:41:9:41:14 | const8 [&ref] | provenance | |
4741
| test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:41:28:41:76 | &... [&ref] | provenance | |
4842
| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | test_cipher.rs:42:30:42:47 | ...::new | provenance | MaD:3 Sink:MaD:3 |
49-
| test_cipher.rs:42:73:42:78 | const8 [&ref] | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | provenance | MaD:20 |
43+
| test_cipher.rs:42:73:42:78 | const8 [&ref] | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | provenance | MaD:13 |
5044
| test_cipher.rs:50:9:50:15 | const10 [element] | test_cipher.rs:51:75:51:81 | const10 [element] | provenance | |
5145
| test_cipher.rs:50:37:50:52 | ...::zeroed | test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | provenance | Src:MaD:7 |
5246
| test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | test_cipher.rs:50:9:50:15 | const10 [element] | provenance | |
5347
| test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | test_cipher.rs:51:31:51:48 | ...::new | provenance | MaD:3 Sink:MaD:3 Sink:MaD:3 |
54-
| test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | provenance | MaD:20 |
48+
| test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | provenance | MaD:13 |
5549
| test_cipher.rs:51:75:51:81 | const10 [element] | test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | provenance | |
5650
| test_cipher.rs:73:9:73:14 | const2 [&ref] | test_cipher.rs:74:46:74:51 | const2 [&ref] | provenance | |
5751
| test_cipher.rs:73:18:73:26 | &... [&ref] | test_cipher.rs:73:9:73:14 | const2 [&ref] | provenance | |
@@ -67,37 +61,21 @@ edges
6761
| test_cookie.rs:22:27:22:32 | array2 | test_cookie.rs:22:26:22:32 | &array2 [&ref] | provenance | |
6862
| test_cookie.rs:38:9:38:14 | array2 | test_cookie.rs:42:34:42:39 | array2 | provenance | |
6963
| test_cookie.rs:38:18:38:37 | ...::from(...) | test_cookie.rs:38:9:38:14 | array2 | provenance | |
70-
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:15 |
71-
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:16 |
72-
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:17 |
73-
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:18 |
74-
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:19 |
64+
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:8 |
65+
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:9 |
66+
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:10 |
67+
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:11 |
68+
| test_cookie.rs:38:28:38:36 | [0u8; 64] | test_cookie.rs:38:18:38:37 | ...::from(...) | provenance | MaD:12 |
7569
| test_cookie.rs:42:34:42:39 | array2 | test_cookie.rs:42:14:42:32 | ...::from | provenance | MaD:2 Sink:MaD:2 |
7670
| test_cookie.rs:49:9:49:14 | array3 [element] | test_cookie.rs:53:34:53:39 | array3 [element] | provenance | |
77-
| test_cookie.rs:49:23:49:25 | 0u8 | test_cookie.rs:49:23:49:29 | ...::from_elem(...) [element] | provenance | MaD:21 |
71+
| test_cookie.rs:49:23:49:25 | 0u8 | test_cookie.rs:49:23:49:29 | ...::from_elem(...) [element] | provenance | MaD:14 |
7872
| test_cookie.rs:49:23:49:29 | ...::from_elem(...) [element] | test_cookie.rs:49:9:49:14 | array3 [element] | provenance | |
7973
| test_cookie.rs:53:34:53:39 | array3 [element] | test_cookie.rs:53:14:53:32 | ...::from | provenance | MaD:2 Sink:MaD:2 |
8074
| test_heuristic.rs:44:9:44:16 | const_iv [&ref] | test_heuristic.rs:45:41:45:48 | const_iv | provenance | |
8175
| test_heuristic.rs:44:30:44:38 | &... [&ref] | test_heuristic.rs:44:9:44:16 | const_iv [&ref] | provenance | |
8276
| test_heuristic.rs:44:31:44:38 | [0u8; 16] | test_heuristic.rs:44:30:44:38 | &... [&ref] | provenance | |
8377
| test_heuristic.rs:64:20:64:27 | [0u8; 16] | test_heuristic.rs:64:19:64:27 | &... | provenance | |
8478
| test_heuristic.rs:65:31:65:38 | [0u8; 16] | test_heuristic.rs:65:30:65:38 | &... | provenance | |
85-
| test_heuristic.rs:69:32:69:32 | 1 | test_heuristic.rs:69:22:69:32 | ... + ... | provenance | MaD:9 |
86-
| test_heuristic.rs:70:23:70:35 | ... << ... | test_heuristic.rs:70:22:70:62 | ... ^ ... | provenance | MaD:13 |
87-
| test_heuristic.rs:70:34:70:35 | 32 | test_heuristic.rs:70:23:70:35 | ... << ... | provenance | MaD:14 |
88-
| test_heuristic.rs:70:41:70:61 | ... & ... | test_heuristic.rs:70:22:70:62 | ... ^ ... | provenance | MaD:13 |
89-
| test_heuristic.rs:70:52:70:61 | 0xFFFFFFFF | test_heuristic.rs:70:41:70:61 | ... & ... | provenance | MaD:12 |
90-
| test_heuristic.rs:72:9:72:16 | mut key1 | test_heuristic.rs:73:5:73:8 | key1 | provenance | |
91-
| test_heuristic.rs:72:20:72:24 | "foo" | test_heuristic.rs:72:20:72:36 | "foo".to_string() | provenance | MaD:8 |
92-
| test_heuristic.rs:72:20:72:36 | "foo".to_string() | test_heuristic.rs:72:9:72:16 | mut key1 | provenance | |
93-
| test_heuristic.rs:73:5:73:8 | key1 | test_heuristic.rs:74:29:74:32 | key1 | provenance | MaD:11 |
94-
| test_heuristic.rs:73:13:73:17 | "bar" | test_heuristic.rs:74:29:74:32 | key1 | provenance | MaD:10 |
95-
| test_heuristic.rs:74:29:74:32 | key1 | test_heuristic.rs:74:28:74:32 | &key1 | provenance | |
96-
| test_heuristic.rs:76:9:76:16 | mut key2 | test_heuristic.rs:77:5:77:8 | key2 | provenance | |
97-
| test_heuristic.rs:76:20:76:24 | "foo" | test_heuristic.rs:76:20:76:36 | "foo".to_string() | provenance | MaD:8 |
98-
| test_heuristic.rs:76:20:76:36 | "foo".to_string() | test_heuristic.rs:76:9:76:16 | mut key2 | provenance | |
99-
| test_heuristic.rs:77:5:77:8 | key2 | test_heuristic.rs:78:29:78:32 | key2 | provenance | MaD:11 |
100-
| test_heuristic.rs:78:29:78:32 | key2 | test_heuristic.rs:78:28:78:32 | &key2 | provenance | |
10179
models
10280
| 1 | Sink: <_ as crypto_common::KeyInit>::new_from_slice; Argument[0]; credentials-key |
10381
| 2 | Sink: <biscotti::crypto::master::Key>::from; Argument[0]; credentials-key |
@@ -106,20 +84,13 @@ models
10684
| 5 | Sink: <cipher::stream_wrapper::StreamCipherCoreWrapper as crypto_common::KeyIvInit>::new; Argument[1]; credentials-iv |
10785
| 6 | Sink: <cookie::secure::key::Key>::from; Argument[0].Reference; credentials-key |
10886
| 7 | Source: core::mem::zeroed; ReturnValue.Element; constant-source |
109-
| 8 | Summary: <_ as alloc::string::ToString>::to_string; Argument[self].Reference; ReturnValue; taint |
110-
| 9 | Summary: <_ as core::ops::arith::Add>::add; Argument[self,0]; ReturnValue; taint |
111-
| 10 | Summary: <_ as core::ops::arith::AddAssign>::add_assign; Argument[0]; Argument[self].Reference; taint |
112-
| 11 | Summary: <_ as core::ops::arith::AddAssign>::add_assign; Argument[self].Reference; Argument[self].Reference; taint |
113-
| 12 | Summary: <_ as core::ops::bit::BitAnd>::bitand; Argument[self,0]; ReturnValue; taint |
114-
| 13 | Summary: <_ as core::ops::bit::BitXor>::bitxor; Argument[self,0]; ReturnValue; taint |
115-
| 14 | Summary: <_ as core::ops::bit::Shl>::shl; Argument[self,0]; ReturnValue; taint |
116-
| 15 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0].Field[alloc::borrow::Cow::Owned(0)]; ReturnValue; value |
117-
| 16 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0].Field[alloc::bstr::ByteString(0)]; ReturnValue; value |
118-
| 17 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0].Field[alloc::collections::binary_heap::BinaryHeap::data]; ReturnValue; value |
119-
| 18 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0].Field[alloc::string::String::vec]; ReturnValue; value |
120-
| 19 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0]; ReturnValue; taint |
121-
| 20 | Summary: <generic_array::GenericArray>::from_slice; Argument[0].Reference; ReturnValue.Reference; value |
122-
| 21 | Summary: alloc::vec::from_elem; Argument[0]; ReturnValue.Element; value |
87+
| 8 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0].Field[alloc::borrow::Cow::Owned(0)]; ReturnValue; value |
88+
| 9 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0].Field[alloc::bstr::ByteString(0)]; ReturnValue; value |
89+
| 10 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0].Field[alloc::collections::binary_heap::BinaryHeap::data]; ReturnValue; value |
90+
| 11 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0].Field[alloc::string::String::vec]; ReturnValue; value |
91+
| 12 | Summary: <alloc::vec::Vec as core::convert::From>::from; Argument[0]; ReturnValue; taint |
92+
| 13 | Summary: <generic_array::GenericArray>::from_slice; Argument[0].Reference; ReturnValue.Reference; value |
93+
| 14 | Summary: alloc::vec::from_elem; Argument[0]; ReturnValue.Element; value |
12394
nodes
12495
| test_cipher.rs:18:9:18:14 | const1 [&ref] | semmle.label | const1 [&ref] |
12596
| test_cipher.rs:18:28:18:36 | &... [&ref] | semmle.label | &... [&ref] |
@@ -193,24 +164,4 @@ nodes
193164
| test_heuristic.rs:65:30:65:38 | &... | semmle.label | &... |
194165
| test_heuristic.rs:65:31:65:38 | [0u8; 16] | semmle.label | [0u8; 16] |
195166
| test_heuristic.rs:67:22:67:22 | 0 | semmle.label | 0 |
196-
| test_heuristic.rs:69:22:69:32 | ... + ... | semmle.label | ... + ... |
197-
| test_heuristic.rs:69:32:69:32 | 1 | semmle.label | 1 |
198-
| test_heuristic.rs:70:22:70:62 | ... ^ ... | semmle.label | ... ^ ... |
199-
| test_heuristic.rs:70:23:70:35 | ... << ... | semmle.label | ... << ... |
200-
| test_heuristic.rs:70:34:70:35 | 32 | semmle.label | 32 |
201-
| test_heuristic.rs:70:41:70:61 | ... & ... | semmle.label | ... & ... |
202-
| test_heuristic.rs:70:52:70:61 | 0xFFFFFFFF | semmle.label | 0xFFFFFFFF |
203-
| test_heuristic.rs:72:9:72:16 | mut key1 | semmle.label | mut key1 |
204-
| test_heuristic.rs:72:20:72:24 | "foo" | semmle.label | "foo" |
205-
| test_heuristic.rs:72:20:72:36 | "foo".to_string() | semmle.label | "foo".to_string() |
206-
| test_heuristic.rs:73:5:73:8 | key1 | semmle.label | key1 |
207-
| test_heuristic.rs:73:13:73:17 | "bar" | semmle.label | "bar" |
208-
| test_heuristic.rs:74:28:74:32 | &key1 | semmle.label | &key1 |
209-
| test_heuristic.rs:74:29:74:32 | key1 | semmle.label | key1 |
210-
| test_heuristic.rs:76:9:76:16 | mut key2 | semmle.label | mut key2 |
211-
| test_heuristic.rs:76:20:76:24 | "foo" | semmle.label | "foo" |
212-
| test_heuristic.rs:76:20:76:36 | "foo".to_string() | semmle.label | "foo".to_string() |
213-
| test_heuristic.rs:77:5:77:8 | key2 | semmle.label | key2 |
214-
| test_heuristic.rs:78:28:78:32 | &key2 | semmle.label | &key2 |
215-
| test_heuristic.rs:78:29:78:32 | key2 | semmle.label | key2 |
216167
subpaths

‎rust/ql/test/query-tests/security/CWE-798/test_heuristic.rs‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -66,14 +66,14 @@ fn test(var_string: &str, var_data: &[u8;16], var_u64: u64) {
6666

6767
mc2.set_salt_u64(0); // $ Alert[rust/hard-coded-cryptographic-value]
6868
mc2.set_salt_u64(var_u64);
69-
mc2.set_salt_u64(var_u64 + 1); // $ SPURIOUS: Alert[rust/hard-coded-cryptographic-value]
70-
mc2.set_salt_u64((var_u64 << 32) ^ (var_u64 & 0xFFFFFFFF)); // $ SPURIOUS: Alert[rust/hard-coded-cryptographic-value]
69+
mc2.set_salt_u64(var_u64 + 1);
70+
mc2.set_salt_u64((var_u64 << 32) ^ (var_u64 & 0xFFFFFFFF));
7171

72-
let mut key1 = "foo".to_string(); // $ Alert[rust/hard-coded-cryptographic-value]
73-
key1 += "bar"; // $ Alert[rust/hard-coded-cryptographic-value]
74-
let _ = MyCryptor::new(&key1); // $ Sink
72+
let mut key1 = "foo".to_string(); // $ MISSING: Alert[rust/hard-coded-cryptographic-value]
73+
key1 += "bar"; // $ MISSING: Alert[rust/hard-coded-cryptographic-value]
74+
let _ = MyCryptor::new(&key1);
7575

76-
let mut key2 = "foo".to_string(); // $ SPURIOUS: Alert[rust/hard-coded-cryptographic-value]
76+
let mut key2 = "foo".to_string();
7777
key2 += var_string;
78-
let _ = MyCryptor::new(&key2); // $ Sink
78+
let _ = MyCryptor::new(&key2);
7979
}

0 commit comments

Comments
 (0)