Description

This detector identifies RSA operations that use no padding (raw RSA) in Ruby applications using the OpenSSL library. RSA without padding is cryptographically insecure because it's vulnerable to various attacks including chosen plaintext attacks and doesn't provide semantic security, allowing attackers to potentially decrypt messages or forge signatures.

Detection Strategy

• The OpenSSL library must be imported in the Ruby code (checks for 'openssl' import prefix)

• An RSA operation method is called on an OpenSSL RSA key object (methods like encrypt, decrypt, sign, or verify)

• The RSA key object is created through OpenSSL RSA key creation functions

• The padding argument (second parameter) is explicitly set to a constant indicating no padding (such as OpenSSL::PKey::RSA::NO_PADDING)

• All conditions must be met simultaneously - the vulnerability is flagged when RSA operations use no padding with OpenSSL RSA keys

Vulnerable code example

require 'openssl'

def encrypt_no_padding(data)
  rsa_key = OpenSSL::PKey::RSA.new(2048)
  # VULNERABLE: NO_PADDING makes RSA deterministic and malleable
  rsa_key.public_encrypt(data, OpenSSL::PKey::RSA::NO_PADDING)
end
...

✅ Secure code example

require 'openssl'

def encrypt_no_padding(data)
  rsa_key = OpenSSL::PKey::RSA.new(2048)
  # SAFE: OAEP padding prevents malleability and deterministic encryption
  rsa_key.public_encrypt(data, OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING)
end
...