predicate -> abstract class, updated inline expectations

Author: chanel-y

powershell/ql/src/queries/security/cwe-327/ApprovedCipherMode.ql

@@ -22,7 +22,7 @@ import WeakEncryptionFlow::PathGraph
  * Holds if `name` (lowercase) is the short name of a .NET symmetric algorithm type
  * that has a `Mode` property.
  */
-private predicate isSymmetricAlgorithmTypeName(string name) {
+predicate isSymmetricAlgorithmTypeName(string name) {
   name =
     [
       "aes", "aesmanaged", "aescryptoserviceprovider", "aescng",
@@ -35,40 +35,51 @@ private predicate isSymmetricAlgorithmTypeName(string name) {
 }
 
 /**
- * Holds if `creation` is a data flow node that creates a symmetric algorithm object.
+ * A data flow node that creates a symmetric algorithm object.
  */
-private predicate isSymmetricAlgorithmCreation(DataFlow::Node creation) {
-  // New-Object "System.Security.Cryptography.Xxx" or [Xxx]::new()
-  exists(DataFlow::ObjectCreationNode objCreation, string typeName, string shortName |
-    creation = objCreation and
-    typeName = objCreation.getLowerCaseConstructedTypeName() and
-    isSymmetricAlgorithmTypeName(shortName) and
-    (
-      typeName = shortName or
-      typeName.matches("%." + shortName)
+abstract class SymmetricAlgorithmCreation extends DataFlow::Node { }
+
+/**
+ * A symmetric algorithm creation via `New-Object "System.Security.Cryptography.Xxx"` or `[Xxx]::new()`.
+ */
+class SymmetricAlgorithmNewObject extends SymmetricAlgorithmCreation {
+  SymmetricAlgorithmNewObject() {
+    exists(DataFlow::ObjectCreationNode objCreation, string typeName, string shortName |
+      this = objCreation and
+      typeName = objCreation.getLowerCaseConstructedTypeName() and
+      isSymmetricAlgorithmTypeName(shortName) and
+      (
+        typeName = shortName or
+        typeName.matches("%." + shortName)
+      )
+    )
+  }
+}
+
+/**
+ * A symmetric algorithm creation via `[System.Security.Cryptography.Xxx]::Create()`.
+ */
+class SymmetricAlgorithmFactoryCreate extends SymmetricAlgorithmCreation {
+  SymmetricAlgorithmFactoryCreate() {
+    exists(string typeName |
+      isSymmetricAlgorithmTypeName(typeName) and
+      this =
+        API::getTopLevelMember("system")
+            .getMember("security")
+            .getMember("cryptography")
+            .getMember(typeName)
+            .getMember("create")
+            .asCall()
     )
-  )
-  or
-  // [System.Security.Cryptography.Xxx]::Create()
-  exists(string typeName |
-    isSymmetricAlgorithmTypeName(typeName) and
-    creation =
-      API::getTopLevelMember("system")
-          .getMember("security")
-          .getMember("cryptography")
-          .getMember(typeName)
-          .getMember("create")
-          .asCall()
-  )
+  }
 }
 
 /**
  * A member expression that writes to the `Mode` property of a symmetric algorithm object.
  */
 class SymmetricAlgorithmModeProperty extends MemberExpr {
   SymmetricAlgorithmModeProperty() {
-    exists(DataFlow::Node symAlgCreation, DataFlow::Node qualAccess |
-      isSymmetricAlgorithmCreation(symAlgCreation) and
+    exists(SymmetricAlgorithmCreation symAlgCreation, DataFlow::Node qualAccess |
       qualAccess.getALocalSource() = symAlgCreation and
       qualAccess.asExpr().getExpr() = this.getQualifier() and
       this.getLowerCaseMemberName() = "mode"

powershell/ql/test/query-tests/security/cwe-327/ApprovedCipherMode/Test.ps1

@@ -5,34 +5,34 @@ $aesManaged = New-Object "System.Security.Cryptography.AesManaged"
 
 #Setting weak modes via CipherMode enum
 $badMode = [System.Security.Cryptography.CipherMode]::ECB # $ Source
-$aes.Mode = $badMode
+$aes.Mode = $badMode # $ Alert
 $aesManaged.Mode = $badMode # $ Alert
 
-$aes.Mode = [System.Security.Cryptography.CipherMode]::ECB
+$aes.Mode = [System.Security.Cryptography.CipherMode]::ECB # $ Alert
 $aesManaged.Mode = [System.Security.Cryptography.CipherMode]::ECB # $ Alert
 
 # Setting weak modes directly
-$aes.Mode = "ecb"
-$aesManaged.Mode = "ecb"
+$aes.Mode = "ecb" # $ Alert
+$aesManaged.Mode = "ecb" # $ Alert
 
 # Other symmetric algorithm types
 $rijndael = New-Object "System.Security.Cryptography.RijndaelManaged"
-$rijndael.Mode = [System.Security.Cryptography.CipherMode]::ECB
+$rijndael.Mode = [System.Security.Cryptography.CipherMode]::ECB # $ Alert
 
 $tripleDes = New-Object "System.Security.Cryptography.TripleDESCryptoServiceProvider"
-$tripleDes.Mode = [System.Security.Cryptography.CipherMode]::ECB
+$tripleDes.Mode = [System.Security.Cryptography.CipherMode]::ECB # $ Alert
 
 # [Type]::new() constructor pattern
 $aesCsp = [System.Security.Cryptography.AesCryptoServiceProvider]::new()
-$aesCsp.Mode = [System.Security.Cryptography.CipherMode]::ECB
+$aesCsp.Mode = [System.Security.Cryptography.CipherMode]::ECB # $ Alert
 
 # Partial/short type names
 $aesShort = New-Object AesManaged
-$aesShort.Mode = "ecb"
+$aesShort.Mode = "ecb" # $ Alert
 
 # Integer cipher mode values (ECB = 2)
 $aes2 = [System.Security.Cryptography.Aes]::Create()
-$aes2.Mode = 2
+$aes2.Mode = 2 # $ Alert
 
 # Safe: CBC mode (should not be flagged)
 $aesSafe = [System.Security.Cryptography.Aes]::Create()