Skip to content

Csharp first comprehensive rules - #520

Open
fynnth wants to merge 11 commits into
mainfrom
csharp-first-comprehensive-rules
Open

Csharp first comprehensive rules#520
fynnth wants to merge 11 commits into
mainfrom
csharp-first-comprehensive-rules

Conversation

@fynnth

@fynnth fynnth commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Hi all,

This adds the first iteration of comprehensive detection rule coverage for System.security.cryptography (without chacha20poly1305 since this is covered by #506).
There are known gaps:

  1. parameters are not detected in a proper form (this will be adressed in a separate pr)
  2. sub-namespaces like certificates are not covered (which is one of the most common usages for invoked crypto in this library)
  3. There is an issue with the line mapping and code exclusion for #if/else directive statements and this will need to be fixeed in the parser itself not here.
  4. certain newer features or certain edgecases can break the parser, which results in skipping some files (but around 98-99% should parse and result in findings)

But what is done correctly:

  • All constructors for the crypto in System.security.cryptography should be detected by this pr
  • if properties are simply set statically this should also be detected and impacts the finding at constructor level

I have tested this in the following manner:

  • I set up a docker container that builds all the testfiles and verifies their validity (all that were compilable on linux, some are only for windows)
  • I have run the scanner on all the testfiles and on two open source projects (aspnetcore and bitwarden) where it produced accurate findings, but ran in some of the known gaps with the detailed information.

I think this is a good state to make the pr before reworking the engine for parameters and extending to some additional namespaces.

Best regards,
Fynn

fynnth added 11 commits August 19, 2026 12:40
Ports the AES/AesGcm/AesCcm rule expansion from the aes-related-crypto

reference branch: CreateEncryptor/CreateDecryptor, EncryptCbc/DecryptCbc,

EncryptEcb/DecryptEcb, EncryptCfb/DecryptCfb, Try* variants, GenerateKey/

GenerateIV, and AesGcm/AesCcm Encrypt/Decrypt operations as depending

detection rules on the existing constructor/factory rules.

Adds ModeFactory(String) to emit a constant Mode value when the mode is

encoded in the method name (e.g. EncryptCbc) rather than a parameter, and

wires ENCRYPT/DECRYPT/GENERATEKEY/GENERATEIV functionality translation

into CSharpCipherContextTranslator.

Signed-off-by: Fynn Thierling <fynnth@outlook.de>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
…s extensive testing to be verified and assumed correct

Signed-off-by: Fynn Thierling <fynnth@outlook.de>
…ication and testing

Signed-off-by: Fynn Thierling <fynnth@outlook.de>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
…ring the batch run

Signed-off-by: Fynn Thierling <fynnth@outlook.de>
@fynnth
fynnth marked this pull request as ready for review August 21, 2026 09:53
@fynnth
fynnth requested a review from a team as a code owner August 21, 2026 09:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant