Writing Detekt Security Rules for Kotlin

I have generated the detekt rule for detecting DES encryption calls, including the rule class, test suite, and configuration wiring.

Dangerous Call Rule: Weak Cipher Detection

package io.github.security.rules.a02

import io.gitlab.arturbosch.detekt.api.*
import org.jetbrains.kotlin.psi.KtCallExpression
import org.jetbrains.kotlin.psi.psiUtil.contains

/**
 * OWASP A02:2021 — Cryptographic Failures
 *
 * DES is considered cryptographically broken and insecure.
 * 
 * Non-compliant:
 *   Cipher.getInstance("DES")
 *
 * Compliant:
 *   Cipher.getInstance("AES/GCM/NoPadding")
 */
class WeakCipherRule(config: Config) : SecurityRule(config) {

    override val issue = Issue(
        id = "WeakCipherDES",
        severity = Severity.Security,
        description = "DES is a broken cipher. Use AES/GCM instead.",
        debt = Debt.TEN_MINS,
    )

    private val weakAlgorithms = setOf("DES", "DESede")

    override fun visitCallExpression(expression: KtCallExpression) {
        super.visitCallExpression(expression)
        
        if (!expression.text.contains("getInstance")) return

        val arguments = expression.valueArguments
        if (arguments.isEmpty()) return

        val argumentText = arguments[0].getArgumentExpression()?.text?.replace("\"", "")
        
        if (weakAlgorithms.any { argumentText?.contains(it) == true }) {
            reportAt(expression, "Insecure encryption algorithm (DES) detected.")
        }
    }
}

Test Suite Structure

class WeakCipherRuleTest {
    private val rule = WeakCipherRule(Config.empty)

    @Test
    fun `flags DES getInstance`() {
        val code = """val c = Cipher.getInstance("DES")"""
        assertThat(rule.lint(code)).hasSize(1)
    }

    @Test
    fun `ignores AES getInstance`() {
        val code = """val c = Cipher.getInstance("AES/GCM/NoPadding")"""
        assertThat(rule.lint(code)).isEmpty()
    }

    @Test
    fun `isolation - does not flag coroutine security issues`() {
        val code = """suspend fun secure() = withContext(Dispatchers.IO) {}"""
        assertThat(rule.lint(code)).isEmpty()
    }
}

Next steps

1. Add WeakCipherRule to your SecurityRuleSetProvider.
2. Append WeakCipherDES: active: true to your detekt.yml.
3. Map WeakCipherDES to CWE-327 in your CweMapping.kt file.