mcp-server-semgrep/semgrep-rules/java/lang/security/audit/md5-used-as-password.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: md5-used-as-password
  languages: [java]
  severity: WARNING
  message: >-
    It looks like MD5 is used as a password hash. MD5 is not considered a
    secure password hash because it can be cracked by an attacker in a short
    amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt.
    You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")`
    or, if using Spring, `org.springframework.security.crypto.bcrypt`.
  metadata:
    category: security
    technology:
    - java
    - md5
    references:
    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
    - https://github.com/returntocorp/semgrep-rules/issues/1609
    - https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory
    - https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: |
        $TYPE $MD = MessageDigest.getInstance("MD5");
        ...
    - pattern: $MD.digest(...);
  pattern-sinks:
  - patterns:
    - pattern: $MODEL.$METHOD(...);
    - metavariable-regex:
        metavariable: $METHOD
        regex: (?i)(.*password.*)