Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-008

Weak or ECB-mode cipher via Cipher.getInstance

highKotlinCWE-327CVSS 7.5

What it detects

Requesting DES, RC4, or AES in ECB mode from Cipher.getInstance provides inadequate confidentiality.

How to fix

Use AES in GCM mode (AES/GCM/NoPadding) with a securely generated random IV.

Vulnerable — Shield flags thisCryptoUtil.kt
import javax.crypto.Cipher
import javax.crypto.SecretKey

fun encrypt(data: ByteArray, key: SecretKey): ByteArray {
    val cipher = Cipher.getInstance("AES/ECB/PKCS5Padding")
    cipher.init(Cipher.ENCRYPT_MODE, key)
    return cipher.doFinal(data)
}
Fixed — scans cleanCryptoUtil.kt
import java.security.SecureRandom
import javax.crypto.Cipher
import javax.crypto.SecretKey
import javax.crypto.spec.GCMParameterSpec

fun encrypt(data: ByteArray, key: SecretKey): ByteArray {
    val iv = ByteArray(12).also { SecureRandom().nextBytes(it) }
    val cipher = Cipher.getInstance("AES/GCM/NoPadding")
    cipher.init(Cipher.ENCRYPT_MODE, key, GCMParameterSpec(128, iv))
    return iv + cipher.doFinal(data)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-008: Weak or ECB-mode cipher via Cipher.getInstance — Zennoxa Shield