gitlab.security_code_scan.SCS0010-1

unknown
Download Count*
License

The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.

Run Locally

Run in CI

Defintion

rules:
  - id: security_code_scan.SCS0010-1
    patterns:
      - pattern-inside: |
          using System.Security.Cryptography;
          ...
      - pattern-either:
          - pattern-regex: .*DES\.Create\(\);
          - pattern: new DESCryptoServiceProvider();
          - pattern-regex: .*TripleDES\.Create\(\);
          - pattern: new TripleDESCryptoServiceProvider();
          - pattern-regex: .*RC2\.Create\(\);
          - pattern: new RC2CryptoServiceProvider();
    message: >
      The use of a broken or risky cryptographic algorithm is an unnecessary
      risk that may result in

      the exposure of sensitive information.
    languages:
      - csharp
    severity: WARNING
    metadata:
      category: security
      cwe: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      license: MIT