Description

This detector identifies the use of weak or insecure HMAC hashing algorithms in Scala code. When a cryptographic HMAC operation is performed using a known-weak algorithm (e.g., MD5 or SHA1-based MACs), an attacker may be able to forge authentication tags or exploit hash collisions, undermining message integrity and authentication guarantees.

Detection Strategy

• A relevant cryptographic library (e.g., javax.crypto or a similar HMAC/crypto library) must be imported in the Scala file. If no such library import is detected, the file is skipped entirely.

• The detector targets method call expressions that match known HMAC sink operations (e.g., 'doFinal', 'update', or equivalent MAC computation methods). Only calls matching the defined set of sink method names are considered.

• The first argument passed to the sink method call is inspected for a 'dangerous smell' — meaning it must carry data that is considered security-sensitive or non-constant (e.g., a user-supplied or non-trivial message value), ruling out benign constant inputs.

• The object on which the sink method is invoked must be traced back to its definition and verified to use a weak MAC algorithm. This means the object (e.g., a Mac instance) must have been initialized or configured with a weak algorithm identifier such as 'HmacMD5' or 'HmacSHA1'. If all three conditions are met — matching sink expression, dangerous message argument, and weak MAC object definition — the call site is reported as vulnerable.

Vulnerable code example

import java.nio.charset.StandardCharsets
import javax.crypto.Mac
import javax.crypto.spec.SecretKeySpec

object Signer {
  private val Algorithm = "HmacSHA1" // SHA1 is weak for HMAC password hashing

  // Vulnerable 1 - HmacMD5 is cryptographically broken...

✅ Secure code example

import java.nio.charset.StandardCharsets
import javax.crypto.Mac
import javax.crypto.spec.SecretKeySpec

object Signer {
  private val Algorithm = "HmacSHA256" // Use SHA256 instead of weak SHA1

  // Fixed 1 - HmacSHA256 replaces broken HmacMD5...