Create rule S3329: Cipher Block Chaining IVs should be unpredictable (#4658)

* Add go to rule S3329

* Add description for S3329 for Go

* Update rules/S3329/go/rule.adoc

Co-authored-by: teemu-rytilahti-sonarsource <teemu.rytilahti@sonarsource.com>

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: teemu-rytilahti-sonarsource <teemu.rytilahti@sonarsource.com>
This commit is contained in:
github-actions[bot] 2025-02-12 10:19:39 +01:00 committed by GitHub
parent 162d5baaf8
commit c79083491d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 77 additions and 0 deletions

View File

@ -0,0 +1,2 @@
{
}

75
rules/S3329/go/rule.adoc Normal file
View File

@ -0,0 +1,75 @@
include::../summary.adoc[]
== Why is this an issue?
include::../rationale.adoc[]
include::../impact.adoc[]
== How to fix it
=== Code examples
==== Noncompliant code example
[source,go,diff-id=1,diff-type=noncompliant]
----
import (
"crypto/cipher"
)
func encrypt(block cipher.Block, plaintext []byte) {
iv := []byte("fixed IVfixed IV")
encrypter := cipher.NewCBCEncrypter(block, iv) // Noncompliant
encrypter.CryptBlocks(plaintext, plaintext)
}
----
==== Compliant solution
include::../common/fix/explicit-fix.adoc[]
[source,go,diff-id=1,diff-type=compliant]
----
import (
"crypto/cipher"
"crypto/rand"
)
func encrypt(block cipher.Block, plaintext []byte) {
iv := make([]byte, block.BlockSize())
rand.Read(iv)
encrypter := cipher.NewCBCEncrypter(block, iv)
encrypter.CryptBlocks(plaintext, plaintext)
}
----
=== How does this work?
include::../common/fix/fix.adoc[]
== Resources
include::../common/resources/docs.adoc[]
include::../common/resources/articles.adoc[]
include::../common/resources/presentations.adoc[]
include::../common/resources/standards.adoc[]
ifdef::env-github,rspecator-view[]
'''
== Implementation Specification
(visible only on this page)
include::../message.adoc[]
'''
endif::env-github,rspecator-view[]