Description

Detects when Ruby code explicitly uses ECB (Electronic Codebook) mode for encryption, which is cryptographically weak. ECB mode encrypts identical plaintext blocks into identical ciphertext blocks, revealing patterns in the encrypted data and making it vulnerable to attacks.

Detection Strategy

• Reports vulnerabilities when the OpenSSL library is imported in Ruby code

• Identifies method calls that configure cipher modes with explicit ECB encryption

• Triggers when cipher configuration explicitly specifies ECB mode as the encryption method

Vulnerable code example

require 'openssl'

def encrypt_data(key, data)
  cipher = OpenSSL::Cipher.new('aes-256-ecb') # ECB mode is cryptographically insecure
  cipher.encrypt
  cipher.key = key
  cipher.update(data) + cipher.final
end...

✅ Secure code example

require 'openssl'

def encrypt_data(key, data)
  cipher = OpenSSL::Cipher.new('aes-256-gcm') # GCM provides authenticated encryption
  cipher.encrypt
  cipher.key = key
  iv = cipher.random_iv # Generate random IV for security
  encrypted = cipher.update(data) + cipher.final...