From 16a394bc6e6feee778ef3da2c958fb13fbfa3d49 Mon Sep 17 00:00:00 2001 From: Sam Pillsworth Date: Tue, 17 Oct 2023 16:40:47 -0400 Subject: [PATCH] improved documentation --- docs/index.md | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/docs/index.md b/docs/index.md index 28f38e8..02b396b 100644 --- a/docs/index.md +++ b/docs/index.md @@ -1,5 +1,7 @@ ## semgrep-scalafix +The goal of semgrep-scalafix is to provide scalafix rules for checks that exist as [semgrep rules](https://semgrep.dev/p/scala). + ### Usage This library is currently available for Scala binary versions 2.13 and 3.1. @@ -7,7 +9,31 @@ This library is currently available for Scala binary versions 2.13 and 3.1. To use the latest version, include the following in your `build.sbt`: ```scala -libraryDependencies ++= Seq( +ThisBuild / scalafixDependencies += "com.banno" %% "semgrep-scalafix" % "@VERSION@" -) +``` + +Once enabled, configure which rules scalafix will run by adding them to your `.scalafix.conf` file like so: +``` +//.scalafix.conf +rules = [ + NoRsaWithoutPadding +] +``` + + +### Available Rules + +#### NoRsaWithoutPadding +Relevant semgrep rule: [scala.lang.security.audit.rsa-padding-set.rsa-padding-set](https://semgrep.dev/r?q=scala.lang.security.audit.rsa-padding-set.rsa-padding-set). + +This scalafix rule will raise an error if a `javax.crypto.Cipher` is instantiated using RSA, any mode, with no padding. For example: + +```scala +import javax.crypto.Cipher + +val badCipher = Cipher.getInstance("RSA/None/NoPadding") // will raise scalafix error +val alsoBad = Cipher.getInstance("RSA/ECB/NoPadding") // will raise scalafix error + +val goodCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding") ```