Description

This detector identifies the use of weak or insecure HMAC hashing algorithms in Java cryptographic code. When sensitive data (such as passwords or secret keys) is passed to an HMAC computation using a weak algorithm (e.g., HmacMD5 or HmacSHA1), it creates a vulnerability where the integrity protection can be compromised due to the algorithm's known weaknesses.

Detection Strategy

• A relevant cryptographic library must be imported (e.g., javax.crypto, java.security) for the analysis to proceed; files without such imports are skipped.

• A method call expression must match one of the known sink patterns associated with HMAC operations (e.g., calls like `doFinal`, `update`, or similar Mac API methods that process the message to be authenticated).

• The method call must have an associated object (the Mac/HMAC instance), and that object's initialization must trace back to an unsafe algorithm definition — specifically a weak algorithm such as HmacMD5 or HmacSHA1 (e.g., via `Mac.getInstance('HmacMD5')`).

• The argument passed to the sink method (the message being hashed) must be considered sensitive — for example, it originates from a secret key, password, credential, or other security-sensitive data source.

• All four conditions must hold simultaneously: a crypto library is imported, the method call matches a known sink, the object was initialized with a weak algorithm, and the processed data is sensitive.

Vulnerable code example

import java.nio.charset.StandardCharsets;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.digest.HmacAlgorithms;
import org.apache.commons.codec.digest.HmacUtils;

class Signer {
...

✅ Secure code example

import java.nio.charset.StandardCharsets;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.digest.HmacAlgorithms;
import org.apache.commons.codec.digest.HmacUtils;

class Signer {
...