APPSEC-2489 SONARJAVA-6939 Add CryptographicKeySizeConfiguration to appsec package

commons/src/main/java/org/sonarsource/analyzer/commons/appsec/CryptographicKeySizeConfiguration.java

@@ -0,0 +1,109 @@
+/*
+ * SonarSource Analyzers Commons
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonarsource.analyzer.commons.appsec;
+
+import java.util.HashMap;
+import java.util.Locale;
+import java.util.Map;
+import java.util.OptionalInt;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Provides default minimum key sizes for common cryptographic algorithms and utilities
+ * for parsing and merging user-supplied key-size configuration.
+ *
+ * <p>The configuration format is a comma-separated list of {@code ALGORITHM:minKeySize} pairs,
+ * for example {@code "RSA:2048,AES:256"}. Algorithm names are case-insensitive.</p>
+ *
+ * <p>The {@link #effectiveKeySizes(String)} method applies user-supplied overrides on top of
+ * the {@link #DEFAULT_KEY_SIZES defaults}, so only the explicitly listed algorithms are
+ * overridden — the rest keep their defaults.</p>
+ */
+public final class CryptographicKeySizeConfiguration {
+
+  /**
+   * Default minimum key sizes for common cryptographic algorithms, in {@code ALGORITHM:minKeySize} format.
+   * This string is a compile-time constant and can be used as a {@code @RuleProperty} default value.
+   */
+  public static final String DEFAULT_KEY_SIZES = "RSA:2048,DH:2048,DIFFIEHELLMAN:2048,DSA:2048,AES:128,EC:224";
+
+  /**
+   * Pattern that matches standard EC curve names (e.g. {@code secp256r1}, {@code prime192v2})
+   * and captures the key-bit count as group 2.
+   */
+  public static final Pattern EC_CURVE_KEY_PATTERN = Pattern.compile("^(secp|prime|sect|c2tnb)(\\d+)");
+
+  private CryptographicKeySizeConfiguration() {
+  }
+
+  /**
+   * Parses a comma-separated list of {@code ALGORITHM:minKeySize} pairs into a map.
+   * Algorithm names are normalized to upper case. Invalid or malformed entries are silently ignored.
+   *
+   * @param input a string like {@code "RSA:2048,AES:256"}
+   * @return a mutable map from upper-cased algorithm name to minimum key size
+   */
+  public static Map<String, Integer> parseKeySizes(String input) {
+    Map<String, Integer> result = new HashMap<>();
+    for (String entry : input.split(",")) {
+      String[] parts = entry.trim().split(":");
+      if (parts.length == 2) {
+        try {
+          String algorithm = parts[0].trim().toUpperCase(Locale.ROOT);
+          int keySize = Integer.parseInt(parts[1].trim());
+          if (!algorithm.isEmpty() && keySize > 0) {
+            result.put(algorithm, keySize);
+          }
+        } catch (NumberFormatException e) {
+          // ignore invalid entries
+        }
+      }
+    }
+    return result;
+  }
+
+  /**
+   * Returns the effective key-size map: starts from {@link #DEFAULT_KEY_SIZES} and applies
+   * {@code userConfig} overrides on top. Only the algorithms listed in {@code userConfig} are
+   * overridden; others keep their default values.
+   *
+   * @param userConfig a string in the same format as {@link #DEFAULT_KEY_SIZES}
+   * @return a mutable map from upper-cased algorithm name to minimum key size
+   */
+  public static Map<String, Integer> effectiveKeySizes(String userConfig) {
+    Map<String, Integer> map = parseKeySizes(DEFAULT_KEY_SIZES);
+    map.putAll(parseKeySizes(userConfig));
+    return map;
+  }
+
+  /**
+   * Extracts the key-bit count from a standard EC curve name.
+   * Recognizes curves with prefixes {@code secp}, {@code prime}, {@code sect}, and {@code c2tnb}
+   * (e.g. {@code secp256r1} → 256, {@code prime192v2} → 192).
+   *
+   * @param curveName the EC curve name string
+   * @return the parsed key size in bits, or empty if the curve name does not match the expected pattern
+   */
+  public static OptionalInt extractEcKeySize(String curveName) {
+    Matcher matcher = EC_CURVE_KEY_PATTERN.matcher(curveName);
+    if (matcher.find()) {
+      return OptionalInt.of(Integer.parseInt(matcher.group(2)));
+    }
+    return OptionalInt.empty();
+  }
+}

commons/src/test/java/org/sonarsource/analyzer/commons/appsec/CryptographicKeySizeConfigurationTest.java

@@ -0,0 +1,126 @@
+/*
+ * SonarSource Analyzers Commons
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonarsource.analyzer.commons.appsec;
+
+import java.util.Map;
+import java.util.OptionalInt;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class CryptographicKeySizeConfigurationTest {
+
+  @Test
+  void defaultKeySizes_containsAllExpectedAlgorithms() {
+    Map<String, Integer> defaults = CryptographicKeySizeConfiguration.parseKeySizes(
+      CryptographicKeySizeConfiguration.DEFAULT_KEY_SIZES);
+
+    assertThat(defaults)
+      .containsEntry("RSA", 2048)
+      .containsEntry("DH", 2048)
+      .containsEntry("DIFFIEHELLMAN", 2048)
+      .containsEntry("DSA", 2048)
+      .containsEntry("AES", 128)
+      .containsEntry("EC", 224);
+  }
+
+  @Test
+  void parseKeySizes_normalizesAlgorithmNamesToUpperCase() {
+    Map<String, Integer> result = CryptographicKeySizeConfiguration.parseKeySizes("rsa:4096,aes:256");
+    assertThat(result)
+      .containsEntry("RSA", 4096)
+      .containsEntry("AES", 256);
+  }
+
+  @Test
+  void parseKeySizes_ignoresInvalidEntries() {
+    Map<String, Integer> result = CryptographicKeySizeConfiguration.parseKeySizes("RSA:2048,BROKEN,AES:notanumber,DSA:1024");
+    assertThat(result)
+      .containsEntry("RSA", 2048)
+      .containsEntry("DSA", 1024)
+      .doesNotContainKey("BROKEN")
+      .doesNotContainKey("AES");
+  }
+
+  @Test
+  void parseKeySizes_ignoresEntriesWithEmptyAlgorithmName() {
+    Map<String, Integer> result = CryptographicKeySizeConfiguration.parseKeySizes(":2048,RSA:4096");
+    assertThat(result)
+      .containsEntry("RSA", 4096)
+      .hasSize(1);
+  }
+
+  @Test
+  void parseKeySizes_ignoresEntriesWithNonPositiveKeySize() {
+    Map<String, Integer> result = CryptographicKeySizeConfiguration.parseKeySizes("RSA:0,DSA:-1,AES:256");
+    assertThat(result)
+      .containsEntry("AES", 256)
+      .doesNotContainKey("RSA")
+      .doesNotContainKey("DSA");
+  }
+
+  @Test
+  void parseKeySizes_toleratesWhitespace() {
+    Map<String, Integer> result = CryptographicKeySizeConfiguration.parseKeySizes(" RSA : 4096 , AES : 256 ");
+    assertThat(result)
+      .containsEntry("RSA", 4096)
+      .containsEntry("AES", 256);
+  }
+
+  @Test
+  void effectiveKeySizes_appliesUserOverridesOnTopOfDefaults() {
+    Map<String, Integer> effective = CryptographicKeySizeConfiguration.effectiveKeySizes("RSA:4096,AES:64");
+
+    assertThat(effective)
+      .containsEntry("RSA", 4096)   // overridden
+      .containsEntry("AES", 64)     // overridden
+      .containsEntry("DH", 2048)    // default preserved
+      .containsEntry("DSA", 2048)   // default preserved
+      .containsEntry("EC", 224);    // default preserved
+  }
+
+  @Test
+  void effectiveKeySizes_withEmptyUserConfig_returnsDefaults() {
+    Map<String, Integer> effective = CryptographicKeySizeConfiguration.effectiveKeySizes("");
+    Map<String, Integer> defaults = CryptographicKeySizeConfiguration.parseKeySizes(
+      CryptographicKeySizeConfiguration.DEFAULT_KEY_SIZES);
+
+    assertThat(effective).containsAllEntriesOf(defaults);
+  }
+
+  @ParameterizedTest
+  @CsvSource({
+    "secp112r1, 112",
+    "secp256r1, 256",
+    "prime192v2, 192",
+    "sect163k1, 163",
+    "c2tnb191v1, 191",
+  })
+  void extractEcKeySize_recognizesStandardCurves(String curveName, int expectedBits) {
+    assertThat(CryptographicKeySizeConfiguration.extractEcKeySize(curveName))
+      .isEqualTo(OptionalInt.of(expectedBits));
+  }
+
+  @ParameterizedTest
+  @ValueSource(strings = {"EC", "some123v123", "primee123v23", "unknown"})
+  void extractEcKeySize_returnsEmptyForUnrecognizedNames(String curveName) {
+    assertThat(CryptographicKeySizeConfiguration.extractEcKeySize(curveName)).isEmpty();
+  }
+}