[sam-robson]

Summary

algorithmRegex in Encryption.qll previously had two branches: one for exact case and one for all-lowercase. Strings that mixed case across / segments, such as "AES/CBC/PKCS5PADDING" or "AES/cbc/Pkcs5Padding", matched neither branch, so java/weak-cryptographic-algorithm and java/potentially-weak-cryptographic-algorithm missed them.

 bindingset[algorithmString]
 private string algorithmRegex(string algorithmString) {
   result =
     "((^|.*[^A-Z])(" + algorithmString + ")([^A-Z].*|$))"
       + "|" +
     "((^|.*[A-Z]{2}|.*[^a-zA-Z])(" + algorithmString.toLowerCase() + ")([^a-z].*|$))"
+      + "|" +
+    "((^|.*[^a-zA-Z])(?i)(" + algorithmString + ")([^a-zA-Z].*|$))"
 }

• Add a case-insensitive branch to algorithmRegex when the algorithm name is bounded by start/end of string or non-alphabetic characters. This matches any casing variant (AES/CBC/PKCS5PADDING, AES/cbc/Pkcs5Padding, AES/ecb/NoPadding) while preserving the existing word-boundary protections against camelCase and English words (GetPrc2, Description, DESTROY, species, AESEncryption).
• Add (?i) to the AES(?![^a-zA-Z](?i)(ECB|CBC/PKCS[57]Padding)) negative lookahead in getASecureAlgorithmName() so mixed-case weak modes are not classified as secure AES.
• Add (?i) to the RSA/ECB.* exclusion in BrokenCryptoAlgorithmQuery.qll so mixed-case Rsa/Ecb/... strings remain excluded.

Evidence

• codeql test run java/ql/test/query-tests/security/CWE-327/semmle/tests java/ql/test/library-tests/Encryption passes all 5 tests (BrokenCryptoAlgorithm.qlref, MaybeBrokenCryptoAlgorithm.qlref, secure.ql, cryptoalgospec.ql, insecure.ql).

[Copilot]

🟡 Changes recommended

The exclusion leaves rsa/ECB/NoPadding unreported because the RSA-without-OAEP query only recognizes the case-sensitive RSA/ prefix.

1 open issue

• Make RSA-without-OAEP matching case-insensitive · New

What changed in this PR

Updates Java’s weak-cryptography analysis to recognize mixed-case algorithm strings while retaining identifier-boundary checks.

Changes:

• Add case-insensitive algorithm matching and adjust secure-AES classification.
• Make the RSA/ECB exclusion case-insensitive.
• Add AES/CBC regression cases, expected alerts, and an analysis change note.

File	Description
java/​ql/​test/​query-tests/​security/​CWE-327/​semmle/​tests/​Test.java	Adds AES/CBC cases with varied casing.
java/​ql/​test/​query-tests/​security/​CWE-327/​semmle/​tests/​BrokenCryptoAlgorithm.expected	Records alerts for the added cases.
java/​ql/​lib/​semmle/​code/​java/​security/​Encryption.qll	Extends algorithm matching and adjusts the secure-AES guard.
java/​ql/​lib/​semmle/​code/​java/​security/​BrokenCryptoAlgorithmQuery.qll	Makes the RSA/ECB exclusion case-insensitive.
java/​ql/​lib/​change-notes/​2026-11-05-weak-crypto-case-sensitivity.md	Documents the expanded case-insensitive detection.

_{Review effort: Max (auto)}

[Copilot]

🔵 Needs a closer look

The new regex treats property-based Rsa/ECB/NoPadding as secure, suppressing the potentially-weak-cryptography alert without a replacement RSA-without-OAEP alert.

1 open issue

• Make RSA-without-OAEP matching case-insensitive

1 previously missed issue

In code that hasn't changed since last review

Preserve weak-cryptography alerts for non-OAEP RSA property values

java/​ql/​lib/​semmle/​code/​java/​security/​Encryption.qll:203

The new branch makes a property value such as Rsa/ECB/NoPadding match the secure regex, so Cipher.getInstance(props.getProperty("algorithm")) loses its potentially-weak-cryptography alert. RsaWithoutOaepConfig only accepts compile-time constants, so no RSA-without-OAEP alert replaces it. Model non-OAEP RSA property values in that query, or keep them eligible for the potentially-weak query.

_{Review effort: Max (auto)}

[owen-mc]

The added commit addressed CCR's original review comment. The second review comment, about property-based RSA, remains a coverage gap. But it already existed for uppercase and lowercase spellings. This PR makes it also exist for mixed-case property values. But this pre-existing issue shouldn't be fixed in this PR.

This all looks good. I've started a DCA run to check performance. If that is fine then I will approve and merge.