mcp-server-semgrep/semgrep-rules/java/lang/security/audit/crypto/no-static-initialization-vector.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: no-static-initialization-vector
  message: >-
    Initialization Vectors (IVs) for block ciphers should be randomly generated
    each time they are used. Using a static IV means the same plaintext
    encrypts to the same ciphertext every time, weakening the strength
    of the encryption.
  metadata:
    cwe:
    - 'CWE-329: Generation of Predictable IV with CBC Mode'
    owasp:
    - A02:2021 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.5 Insecure Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    references:
    - https://cwe.mitre.org/data/definitions/329.html
    category: security
    technology:
    - java
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
  severity: WARNING
  languages: [java]
  pattern-either:
  - pattern: |
      byte[] $IV = {
          ...
      };
      ...
      new IvParameterSpec($IV, ...);
  - pattern: |
      class $CLASS {
          byte[] $IV = {
              ...
          };
          ...
          $METHOD(...) {
              ...
              new IvParameterSpec($IV, ...);
              ...
          }
      }