Refactor weak encryption mode detection to use regex for broader matc…

…hing and simplify summary
OWASP · Feb 1, 2025 · e58bac4 · e58bac4
1 parent 8869c4a
commit e58bac4
Showing 1 changed file with 3 additions and 6 deletions.
diff --git a/rules/mastg-android-weak-encryption-modes.yaml b/rules/mastg-android-weak-encryption-modes.yaml
@@ -4,13 +4,10 @@ rules:
       - java
     severity: WARNING
     metadata:
-      summary: This rule looks for weak encryption modes such as AES-ECB.
+      summary: This rule looks for weak encryption modes.
     message: "[MASVS-CRYPTO-1] Weak encryption modes found in use."
     pattern-either:
-      - pattern: Cipher.getInstance("AES/ECB/NoPadding")
       - pattern: Cipher.getInstance("AES")
-      - pattern: Cipher.getInstance("AES/ECB/PKCS5Padding")
-      - pattern: Cipher.getInstance("AES/ECB/ISO10126Padding")
-      - pattern: Cipher.getInstance("DES/ECB/PKCS5Padding")
-      - pattern: Cipher.getInstance("DESede/ECB/PKCS5Padding")
+      - pattern-regex: Cipher\.getInstance\("?[A-Za-z0-9]+/ECB(/[A-Za-z0-9]+)?"?\)
+