[asya-vorobeva]

Extracts language-agnostic crypto key-size configuration logic into sonar-analyzer-commons so it can be reused by other language analyzers. Provides default minimum key sizes, a configurable parse/merge API, and EC curve name key-size extraction.

[hashicorp-vault-sonar-prod]

APPSEC-2489
SONARJAVA-6939

[gitar-bot]

Code Review ✅ Approved 3 resolved / 3 findings

Extracts language-agnostic crypto key-size configuration logic into sonar-analyzer-commons for reuse across language analyzers. Resolved NumberFormatException on long digit runs in extractEcKeySize and fixed EC curve pattern case-sensitivity to align with the rest of the API.

✅ 3 resolved

✅ Edge Case: extractEcKeySize throws NumberFormatException on long digit runs

📄 commons/src/main/java/org/sonarsource/analyzer/commons/appsec/CryptographicKeySizeConfiguration.java:102-107
EC_CURVE_KEY_PATTERN captures (\d+) with no length bound, so any input whose digit run exceeds Integer.MAX_VALUE — e.g. a string literal "secp99999999999" taken from analyzed source code — makes Integer.parseInt(matcher.group(2)) throw an uncaught NumberFormatException instead of returning OptionalInt.empty() as the javadoc promises; in a rule that feeds source-code strings into this helper, that aborts analysis of the file. Note that parseKeySizes already guards its parseInt with a try/catch, so the two entry points are inconsistent. Bound the digit group or catch the exception.

✅ Bug: EC curve pattern is case-sensitive, unlike rest of the API

📄 commons/src/main/java/org/sonarsource/analyzer/commons/appsec/CryptographicKeySizeConfiguration.java:31 📄 commons/src/main/java/org/sonarsource/analyzer/commons/appsec/CryptographicKeySizeConfiguration.java:49 📄 commons/src/main/java/org/sonarsource/analyzer/commons/appsec/CryptographicKeySizeConfiguration.java:102-107
EC_CURVE_KEY_PATTERN has no Pattern.CASE_INSENSITIVE flag, so extractEcKeySize("SECP256R1") or extractEcKeySize("Prime256v1") returns empty even though those spellings are accepted by JCA providers (ECGenParameterSpec name lookup is case-insensitive) and will appear in analyzed code — a silent false negative for a key-size rule. This also contradicts the class javadoc's case-insensitivity promise and the convention in the sibling appsec classes, which compile every source-derived pattern with CASE_INSENSITIVE.

✅ Edge Case: EC prefix list omits c2pnb/c2onb X9.62 binary curves

📄 commons/src/main/java/org/sonarsource/analyzer/commons/appsec/CryptographicKeySizeConfiguration.java:49 📄 commons/src/main/java/org/sonarsource/analyzer/commons/appsec/CryptographicKeySizeConfiguration.java:96-97
The prefix alternation covers c2tnb but not the sibling X9.62 binary-field families c2pnb and c2onb (e.g. c2pnb163v1, c2pnb176w1, c2onb191v4), which are valid curve names in common providers such as Bouncy Castle. extractEcKeySize("c2pnb163v1") therefore returns empty and a consuming rule cannot flag those weak curves. Add the missing prefixes (or document the omission explicitly if it is intentional).

Review coverage

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[aurelien-coet-sonarsource]

LGTM