Add static analysis rule to detect unsecure random number usage

compiler-plugin-tests/src/test/java/io/ballerina/stdlib/crypto/compiler/staticcodeanalyzer/StaticCodeAnalyzerTest.java

@@ -49,6 +49,7 @@
 import static io.ballerina.scan.RuleKind.VULNERABILITY;
 import static io.ballerina.stdlib.crypto.compiler.staticcodeanalyzer.CryptoRule.AVOID_FAST_HASH_ALGORITHMS;
 import static io.ballerina.stdlib.crypto.compiler.staticcodeanalyzer.CryptoRule.AVOID_REUSING_COUNTER_MODE_VECTORS;
+import static io.ballerina.stdlib.crypto.compiler.staticcodeanalyzer.CryptoRule.AVOID_USING_UNSECURE_RANDOM_NUMBER_GENERATORS;
 import static io.ballerina.stdlib.crypto.compiler.staticcodeanalyzer.CryptoRule.AVOID_WEAK_CIPHER_ALGORITHMS;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
@@ -117,19 +118,28 @@ private void validateRules(List<Rule> rules) {
                 "ballerina/crypto:3",
                 AVOID_REUSING_COUNTER_MODE_VECTORS.getDescription(),
                 VULNERABILITY);
+        Assertions.assertRule(
+                rules,
+                "ballerina/crypto:4",
+                AVOID_USING_UNSECURE_RANDOM_NUMBER_GENERATORS.getDescription(),
+                VULNERABILITY);
     }
 
     private void validateIssues(CryptoRule rule, List<Issue> issues) {
         switch (rule) {
             case AVOID_WEAK_CIPHER_ALGORITHMS:
-                Assert.assertEquals(issues.size(), 4);
+                Assert.assertEquals(issues.size(), 6);
                 Assertions.assertIssue(issues, 0, "ballerina/crypto:1", "aes_cbc.bal",
                         30, 30, Source.BUILT_IN);
-                Assertions.assertIssue(issues, 1, "ballerina/crypto:1", "aes_cbc_as_import.bal",
+                Assertions.assertIssue(issues, 1, "ballerina/crypto:4", "aes_cbc.bal",
                         30, 30, Source.BUILT_IN);
-                Assertions.assertIssue(issues, 2, "ballerina/crypto:1", "aes_ecb.bal",
+                Assertions.assertIssue(issues, 2, "ballerina/crypto:1", "aes_cbc_as_import.bal",
+                        30, 30, Source.BUILT_IN);
+                Assertions.assertIssue(issues, 3, "ballerina/crypto:4", "aes_cbc_as_import.bal",
+                        30, 30, Source.BUILT_IN);
+                Assertions.assertIssue(issues, 4, "ballerina/crypto:1", "aes_ecb.bal",
                         26, 26, Source.BUILT_IN);
-                Assertions.assertIssue(issues, 3, "ballerina/crypto:1", "aes_ecb_as_import.bal",
+                Assertions.assertIssue(issues, 5, "ballerina/crypto:1", "aes_ecb_as_import.bal",
                         26, 26, Source.BUILT_IN);
                 break;
             case AVOID_FAST_HASH_ALGORITHMS:
@@ -186,6 +196,11 @@ private void validateIssues(CryptoRule rule, List<Issue> issues) {
                 Assertions.assertIssue(issues, 5, "ballerina/crypto:3", "mod_var_pos_arg.bal",
                         23, 23, Source.BUILT_IN);
                 break;
+            case AVOID_USING_UNSECURE_RANDOM_NUMBER_GENERATORS:
+                Assert.assertEquals(issues.size(), 1);
+                Assertions.assertIssue(issues, 0, "ballerina/crypto:4", "main.bal",
+                        27, 27, Source.BUILT_IN);
+                break;
             default:
                 Assert.fail("Unhandled rule in validateIssues: " + rule);
                 break;

compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule4/Ballerina.toml

@@ -0,0 +1,8 @@
+[package]
+org = "wso2"
+name = "rule4"
+version = "0.1.0"
+distribution = "2201.12.3"
+
+[build-options]
+observabilityIncluded = true

compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule4/main.bal

@@ -0,0 +1,29 @@
+// Copyright (c) 2025 WSO2 LLC. (http://www.wso2.org)
+//
+// WSO2 LLC. licenses this file to you under the Apache License,
+// Version 2.0 (the "License"); you may not use this file except
+// in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import ballerina/crypto;
+import ballerina/random;
+
+public isolated function main() returns error? {
+    string data = "Hello, World!";
+    byte[16] initialVector = [];
+    byte[16] key = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
+    byte[] dataBytes = data.toBytes();
+    foreach int i in 0 ... 15 {
+        initialVector[i] = <byte>(check random:createIntInRange(0, 255));
+    }
+    byte[] _ = check crypto:encryptAesGcm(dataBytes, key, initialVector);
+}

compiler-plugin-tests/src/test/resources/static_code_analyzer/expected_output/rule1.json

@@ -17,7 +17,7 @@
     },
     "source": "BUILT_IN",
     "fileName": "rule1/aes_cbc.bal",
-    "filePath": "C:/Users/nureka/Documents/GitHub/module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc.bal"
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc.bal"
   },
   {
     "location": {
@@ -37,7 +37,7 @@
     },
     "source": "BUILT_IN",
     "fileName": "rule1/aes_cbc_as_import.bal",
-    "filePath": "C:/Users/nureka/Documents/GitHub/module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc_as_import.bal"
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc_as_import.bal"
   },
   {
     "location": {
@@ -57,7 +57,7 @@
     },
     "source": "BUILT_IN",
     "fileName": "rule1/aes_ecb.bal",
-    "filePath": "C:/Users/nureka/Documents/GitHub/module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_ecb.bal"
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_ecb.bal"
   },
   {
     "location": {
@@ -77,7 +77,7 @@
     },
     "source": "BUILT_IN",
     "fileName": "rule1/aes_ecb_as_import.bal",
-    "filePath": "C:/Users/nureka/Documents/GitHub/module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_ecb_as_import.bal"
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_ecb_as_import.bal"
   },
   {
     "location": {
@@ -97,7 +97,27 @@
     },
     "source": "BUILT_IN",
     "fileName": "rule1/aes_cbc.bal",
-    "filePath": "C:/Users/nureka/Documents/GitHub/module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc.bal"
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc.bal"
+  },
+  {
+    "location": {
+      "filePath": "aes_cbc.bal",
+      "startLine": 30,
+      "endLine": 30,
+      "startColumn": 21,
+      "endColumn": 67,
+      "startOffset": 1203,
+      "length": 46
+    },
+    "rule": {
+      "id": "ballerina/crypto:4",
+      "numericId": 4,
+      "description": "Secure random number generators should not output predictable values",
+      "ruleKind": "VULNERABILITY"
+    },
+    "source": "BUILT_IN",
+    "fileName": "rule1/aes_cbc.bal",
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc.bal"
   },
   {
     "location": {
@@ -117,7 +137,27 @@
     },
     "source": "BUILT_IN",
     "fileName": "rule1/aes_cbc_as_import.bal",
-    "filePath": "C:/Users/nureka/Documents/GitHub/module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc_as_import.bal"
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc_as_import.bal"
+  },
+  {
+    "location": {
+      "filePath": "aes_cbc_as_import.bal",
+      "startLine": 30,
+      "endLine": 30,
+      "startColumn": 21,
+      "endColumn": 62,
+      "startOffset": 1216,
+      "length": 41
+    },
+    "rule": {
+      "id": "ballerina/crypto:4",
+      "numericId": 4,
+      "description": "Secure random number generators should not output predictable values",
+      "ruleKind": "VULNERABILITY"
+    },
+    "source": "BUILT_IN",
+    "fileName": "rule1/aes_cbc_as_import.bal",
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_cbc_as_import.bal"
   },
   {
     "location": {
@@ -137,7 +177,7 @@
     },
     "source": "BUILT_IN",
     "fileName": "rule1/aes_ecb.bal",
-    "filePath": "C:/Users/nureka/Documents/GitHub/module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_ecb.bal"
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_ecb.bal"
   },
   {
     "location": {
@@ -157,6 +197,6 @@
     },
     "source": "BUILT_IN",
     "fileName": "rule1/aes_ecb_as_import.bal",
-    "filePath": "C:/Users/nureka/Documents/GitHub/module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_ecb_as_import.bal"
+    "filePath": "module-ballerina-crypto/compiler-plugin-tests/src/test/resources/static_code_analyzer/ballerina_packages/rule1/aes_ecb_as_import.bal"
   }
 ]