Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(policies): add weak encryption policy #247

Merged

Conversation

elsapet
Copy link
Contributor

@elsapet elsapet commented Dec 14, 2022

Description

An extension to #215

Give policy failure with low severity if we detect a weak encryption library being used for a data type that it not a password

Example

Code

cipher = OpenSSL::Cipher.new('aes-128-cbc')
dsa_encrypt = OpenSSL::PKey::DSA.new(2048)
dsa_encrypt.export(cipher, customer.first_name)

Policy report

Screenshot 2022-12-14 at 10 24 17

Checklist

  • I've added test coverage that shows my fix or feature works as expected.
  • I've updated or added documentation if required.
  • I've included usage information in the description if CLI behavior was updated or added.
  • PR title follows Conventional Commits format

@swarmia
Copy link

swarmia bot commented Dec 14, 2022

@gotbadger gotbadger force-pushed the AMA-3355-insecure-encryption-library-used-no-password-detected branch from 0e0960c to dff3a8c Compare December 14, 2022 16:20
@cfabianski cfabianski merged commit 9d2b498 into main Dec 14, 2022
@cfabianski cfabianski deleted the AMA-3355-insecure-encryption-library-used-no-password-detected branch December 14, 2022 16:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants