Added new rule G407(hardcoded IV/nonce)

The rule is supposed to detect for the usage of hardcoded or static nonce/Iv in many encryption algorithms:

* The different modes of AES (mainly tested here)
* It should be able to work with ascon

Currently the rules doesn't check when constant variables are used.

TODO: Improve the rule, to detected for constatant variable usage

rules/hardcodedIV.go

@@ -0,0 +1,132 @@
+package rules
+
+import (
+	"go/ast"
+
+	"github.com/securego/gosec/v2"
+	"github.com/securego/gosec/v2/issue"
+)
+
+type usesHardcodedIV struct {
+	issue.MetaData
+	trackedFunctions map[string][]int
+}
+
+func (r *usesHardcodedIV) ID() string {
+	return r.MetaData.ID
+}
+
+// The code is a little bit spaghetti and there are things that repeat
+// Can be improved
+func (r *usesHardcodedIV) Match(n ast.Node, c *gosec.Context) (*issue.Issue, error) {
+	// cast n to a call expression, we can do that safely, because this match method gets only called when CallExpr node is found
+	funcCall := n.(*ast.CallExpr)
+
+	// cast to a function call from an object and get the function part; example: a.doSomething()
+	funcSelector, exists := funcCall.Fun.(*ast.SelectorExpr)
+	if exists {
+		//Iterate trough the wanted functions
+		for functionName, functionNumArgsAndNoncePosArr := range r.trackedFunctions {
+			// Check if the call is actually made from an object
+			if _, hasX := funcSelector.X.(*ast.Ident); hasX {
+
+				// Check if the function name matches with the one we look for, and if the function accepts an exact number of arguments(Function signature)
+				if funcSelector.Sel.Name == functionName && len(funcCall.Args) == functionNumArgsAndNoncePosArr[0] {
+
+					// Check the type of the passed argument to the function
+					switch funcCall.Args[functionNumArgsAndNoncePosArr[1]].(type) {
+
+					case *ast.CompositeLit:
+						// Check if the argument is static array
+						if _, isArray := funcCall.Args[functionNumArgsAndNoncePosArr[1]].(*ast.CompositeLit).Type.(*ast.ArrayType); isArray {
+							return c.NewIssue(n, r.ID(), r.What+" by passing hardcoded byte array", r.Severity, r.Confidence), nil
+						}
+
+					case *ast.CallExpr:
+
+						// Check if it's a function call, because []byte() is a function call, and also check if the number of arguments to this call is only 1
+						switch funcCall.Args[functionNumArgsAndNoncePosArr[1]].(*ast.CallExpr).Fun.(type) {
+						case *ast.ArrayType:
+							return c.NewIssue(n, r.ID(), r.What+" by converting static string to a byte array", r.Severity, r.Confidence), nil
+
+						// Check if it's an anonymous function
+						case *ast.FuncLit:
+							functionCalled, _ := funcCall.Args[functionNumArgsAndNoncePosArr[1]].(*ast.CallExpr).Fun.(*ast.FuncLit)
+
+							// Check the type of the last statement in the anonymous function
+							switch functionCalled.Body.List[len(functionCalled.Body.List)-1].(type) {
+
+							case *ast.IfStmt:
+
+								ifStatementContent := functionCalled.Body.List[len(functionCalled.Body.List)-1].(*ast.IfStmt).Body.List
+
+								// check if the if statement has return statement
+								if retStatement, isReturn := ifStatementContent[len(ifStatementContent)-1].(*ast.ReturnStmt); isReturn {
+									argInNestedFunc := retStatement.Results[0]
+
+									// check the type of the returned value
+									switch argInNestedFunc.(type) {
+									case *ast.CompositeLit:
+										// Check if the argument is static array
+										if _, isArray := argInNestedFunc.(*ast.CompositeLit).Type.(*ast.ArrayType); isArray {
+											return c.NewIssue(n, r.ID(), r.What+" by passing hardcoded byte array in a function call", r.Severity, r.Confidence), nil
+										}
+
+									case *ast.CallExpr:
+										if _, ok := argInNestedFunc.(*ast.CallExpr).Fun.(*ast.ArrayType); ok {
+											return c.NewIssue(n, r.ID(), r.What+" by converting static string to a byte array in a function call", r.Severity, r.Confidence), nil
+										}
+									}
+								}
+							case *ast.ReturnStmt:
+
+								argInNestedFunc := functionCalled.Body.List[len(functionCalled.Body.List)-1].(*ast.ReturnStmt).Results[0]
+								switch argInNestedFunc.(type) {
+								case *ast.CompositeLit:
+									// Check if the argument is static array
+									if _, isArray := argInNestedFunc.(*ast.CompositeLit).Type.(*ast.ArrayType); isArray {
+										return c.NewIssue(n, r.ID(), r.What+" by passing hardcoded byte array in a function call", r.Severity, r.Confidence), nil
+									}
+
+								case *ast.CallExpr:
+									if _, ok := argInNestedFunc.(*ast.CallExpr).Fun.(*ast.ArrayType); ok {
+										return c.NewIssue(n, r.ID(), r.What+" by converting static string to a byte array in a function call", r.Severity, r.Confidence), nil
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	// loop through the functions we are checking
+
+	return nil, nil
+}
+
+func NewUsesHardCodedIV(id string, _ gosec.Config) (gosec.Rule, []ast.Node) {
+	calls := make(map[string][]int)
+	// Holds the function name as key, the number of arguments that the function accepts, and at which index of those accepted arguments is the nonce/IV
+	// Example "Test" 3, 1 -- means the function "Test" which accepts 3 arguments, and has the nonce arg as second argument
+
+	calls["Seal"] = []int{4, 1}
+	calls["Open"] = []int{4, 1}
+	calls["NewCBCDecrypter"] = []int{2, 1} //
+	calls["NewCBCEncrypter"] = []int{2, 1} //
+	calls["NewCFBDecrypter"] = []int{2, 1}
+	calls["NewCFBEncrypter"] = []int{2, 1}
+	calls["NewCTR"] = []int{2, 1} //
+	calls["NewOFB"] = []int{2, 1} //
+
+	rule := &usesHardcodedIV{
+		trackedFunctions: calls,
+		MetaData: issue.MetaData{
+			ID:         id,
+			Severity:   issue.High,
+			Confidence: issue.Medium,
+			What:       "Use of hardcoded IV/nonce for encryption",
+		},
+	}
+	return rule, []ast.Node{(*ast.CallExpr)(nil)}
+}

rules/rulelist.go

@@ -100,6 +100,7 @@ func Generate(trackSuppressions bool, filters ...RuleFilter) RuleList {
 		{"G404", "Insecure random number source (rand)", NewWeakRandCheck},
 		{"G405", "Detect the usage of DES or RC4", NewUsesWeakCryptographyEncryption},
 		{"G406", "Detect the usage of deprecated MD4 or RIPEMD160", NewUsesWeakDeprecatedCryptographyHash},
+		{"G407", "Detect the usage of hardcoded Initialization Vector(IV)/Nonce", NewUsesHardCodedIV},
 
 		// blocklist
 		{"G501", "Import blocklist: crypto/md5", NewBlocklistedImportMD5},

rules/rules_test.go

@@ -187,6 +187,66 @@ var _ = Describe("gosec rules", func() {
 			runner("G406", testutils.SampleCodeG406b)
 		})
 
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407b)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407c)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407d)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407e)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407f)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407g)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407h)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407i)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407j)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407k)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407l)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407m)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407n)
+		})
+
+		It("should detect hardcoded nonce/IV", func() {
+			runner("G407", testutils.SampleCodeG407o)
+		})
+
 		It("should detect blocklisted imports - MD5", func() {
 			runner("G501", testutils.SampleCodeG501)
 		})