JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
Java

JAVA.CRYPTO.BASE64 : Unsafe Base64 Encoding (Java)

Summary

Base64 encoding is used. This encoding is relatively easy to decode and should not be used with sensitive data.

Properties

Class Name Unsafe Base64 Encoding (Java)
Significance security
Mnemonic JAVA.CRYPTO.BASE64
Categories
CWE CWE:327 Use of a Broken or Risky Cryptographic Algorithm
CERT-Java CERT-Java:DRD18 Do not use the default behavior in a cryptographic library if it does not use recommended practices
  CERT-Java:MSC02-J Generate strong random numbers
OWASP-2017 OWASP-2017:A2 Broken authentication
OWASP-2021 OWASP-2021:A2 Cryptographic failures
  OWASP-2021:A6 Vulnerable and outdated components
  OWASP-2021:A7 Identification and authorization failures
OWASP-2025 OWASP-2025:A04 Cryptographic Failures
  OWASP-2025:A06 Insecure Design
Availability Available for Java and Kotlin.
Enabling Checks for this warning class are disabled by default, and require pedantic Java analysis mode which is also disabled by default. To enable the checks, make the following changes to the project configuration file. 
JAVA_ANALYSIS_PEDANTIC_MODE = Yes
WARNING_FILTER += allow class="Unsafe Base64 Encoding (Java)"

Example 

import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;

import javax.crypto.Cipher;
import javax.crypto.NoSuchPaddingException;

public class BrokenAlgorithms {

  public static void main(String[] args) throws NoSuchAlgorithmException, NoSuchPaddingException, NoSuchProviderException {
      Cipher.getInstance("DES");                   /* Warnings of two classes issued here:
                                                    * - Cryptographic Algorithm with Risky Default Cipher (Java)
                                                    * - Risky Cryptographic Algorithm (Java)
                                                    */
      Cipher.getInstance("MyComplexAlgo", "myProvider");
      Cipher.getInstance("MD5", "myProvider");     // Weak Hash Algorithm (Java) warning issued here

      String mypassword= "Hello World !";
      Base64.decodeBase64(mypassword.getBytes()); // Unsafe Base64 Encoding (Java) warning issued here

      Cipher.getInstance("AES/ECB/NoPadding");    // Cryptographic Algorithm with Weak Cipher (Java) warning issued here
      Cipher.getInstance("AES");                  // Cryptographic Algorithm with Risky Default Cipher (Java) warning issued here
  }
}

Resolution

Use a safer cryptography algorithm.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

 

To report problems with this documentation, please visit https://support.codesecure.com/.