kotlin

Semgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

Default ruleset for Kotlin, curated by Semgrep.

Run Locally

Rules (68)

kotlin.lang.security.ecb-cipher.ecb-cipher

profile photo of semgrepsemgrep

Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.

kotlin.lang.security.no-null-cipher.no-null-cipher

profile photo of semgrepsemgrep

NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.

kotlin.lang.security.use-of-md5.use-of-md5

profile photo of semgrepsemgrep

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

kotlin.lang.security.use-of-sha1.use-of-sha1

profile photo of semgrepsemgrep

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.