Possible CrySL rules to implement from CryptoGuard Crypto-API Benchmark

[enriozuni]

CryptoGuard Crypto-API Benchmark reports misuses that are not found from static analysis tools such as CogniCrypt. In their list of tests, the following CrySL rules are not implemented and therefore headless tests could not be done.

Reference of the issue is in this link

Java classes that are used in the CryptoGuard tests and are not yet implemented as CrySL rules can be found below.

Checklist:

• javax.net.ssl.X509TrustManager
• javax.net.ssl.HostnameVerifier
• javax.net.ssl.SSLSession
• javax.net.ssl.HttpsURLConnection
• javax.net.ssl.SSLSocket
• javax.net.ssl.SSLSockerFactory
• java.security.cert.CertificateException
• java.security.cert.X509Certificate
• java.net.URL
• java.net.MalformedURLException

[kruegers]

I suspect these will become relevant when you work on this issue.

[AndreSonntag]

javax.net.ssl.X509TrustManager: no security risk
javax.net.ssl.SSLSession: no security risk
java.net.URL: no security risk
javax.net.ssl.HttpsURLConnection: no security risk
java.security.cert.X509Certificate: no security risk

javax.net.ssl.HostnameVerifier: Interface -> just one method, no implementing classes

javax.net.ssl.SSLSocket: rule already exsists
javax.net.ssl.SSLSockerFactory: rule already exsists

Exceptions are not considered