codemod/replace-default-aes-with-explicit-mode
Replace Cipher.getInstance(AES) with explicit Cipher.getInstance(AES/CBC/PKCS5Padding) configuration
# @codemod/replace-default-aes-with-explicit-mode
Replace insecure default AES cipher with explicit CBC mode and padding to prevent cryptographic vulnerabilities.
## Security Issue
**CWE-327: Use of a Broken or Risky Cryptographic Algorithm**
The default AES cipher implementation uses Electronic Codebook (ECB) mode, which provides weak cryptographic security. ECB mode encrypts identical plaintext blocks to identical ciphertext blocks, revealing patterns in the encrypted data.
This codemod addresses **OWASP Top 10 A02:2021 - Cryptographic Failures** by ensuring explicit cipher mode specification.
## What It Does
This codemod automatically transforms insecure AES cipher configurations to use explicit CBC mode with PKCS5Padding:
### Before
```java
Cipher cipher = Cipher.getInstance("AES");
```
### After
```java
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
```
## Transformations Applied
✅ **Direct cipher calls**
```java
// Before
Cipher.getInstance("AES")
javax.crypto.Cipher.getInstance("AES")
// After
Cipher.getInstance("AES/CBC/PKCS5Padding")
javax.crypto.Cipher.getInstance("AES/CBC/PKCS5Padding")
```
✅ **Static imports**
```java
// Before
import static javax.crypto.Cipher.getInstance;
getInstance("AES")
// After
getInstance("AES/CBC/PKCS5Padding")
```
✅ **Cipher algorithm constants**
```java
// Before
private static final String CIPHER_ALGORITHM = "AES";
// After
private static final String CIPHER_ALGORITHM = "AES/CBC/PKCS5Padding";
```
## What's NOT Transformed
❌ **Already explicit configurations** (no changes needed)
```java
Cipher.getInstance("AES/CBC/PKCS5Padding") // ✓ Already secure
Cipher.getInstance("AES/GCM/NoPadding") // ✓ Already secure
```
❌ **Variable parameters** (requires manual review)
```java
String algorithm = getAlgorithm();
Cipher.getInstance(algorithm); // Needs manual review
```
❌ **Non-cipher string literals**
```java
System.out.println("AES"); // Not a cipher call
String comment = "Using AES encryption"; // Just text
```
## Installation & Usage
```bash
# Run directly from registry
npx codemod@latest run @codemod/replace-default-aes-with-explicit-mode
# Or install locally
npm install -g codemod
codemod run @codemod/replace-default-aes-with-explicit-mode /path/to/java/project
```
## Important Security Notes
⚠️ **After applying this codemod, you must:**
1. **Generate and manage Initialization Vectors (IVs)** properly for CBC mode
2. **Use cryptographically secure random IVs** for each encryption operation
3. **Store/transmit IVs alongside encrypted data** (IVs don't need to be secret)
4. **Review any flagged variable parameter cases** manually
Example of proper IV usage:
```java
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
SecureRandom random = new SecureRandom();
byte[] iv = new byte[16];
random.nextBytes(iv);
IvParameterSpec ivSpec = new IvParameterSpec(iv);
cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivSpec);
```
## Security References
- [CWE-327: Use of a Broken or Risky Cryptographic Algorithm](https://cwe.mitre.org/data/definitions/327.html)
- [OWASP A02:2021 - Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)
- [Java Cryptography Architecture Reference Guide](https://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/CryptoSpec.html)
- [NIST SP 800-38A: Block Cipher Modes of Operation](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf)
## Development
```bash
# Test the transformation
pnpm test
# Run type checking
pnpm check-types
# Test on specific directory
pnpm test tests/basic-cipher-getinstance
```
## License
MIT