Description

Detects usage of javax.crypto.NullCipher in Java applications. NullCipher is a mock cipher that performs no encryption, making any data processed through it completely readable and exposing sensitive information. Using NullCipher in production code creates a false sense of security while providing no actual protection.

Detection Strategy

• Check for direct instantiation or usage of 'javax.crypto.NullCipher' class

• Check for usage of 'NullCipher' class when javax.crypto package is imported

• Report vulnerability when either condition is detected in the application code

Vulnerable code example

import javax.crypto.Cipher;
import javax.crypto.NullCipher;

public class InsecureCrypto {
    public byte[] encrypt(String data) {
        NullCipher cipher = new NullCipher();  // Vulnerable: NullCipher provides no encryption
        return cipher.doFinal(data.getBytes()); // Data passes through without encryption
    }...

✅ Secure code example

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;

public class SecureCrypto {
    private final SecretKey key;
    ...