fix(java): match RSA prefix case-insensitively in RsaWithoutOaepQuery

Author: sam-robson

java/ql/lib/change-notes/2026-11-05-weak-crypto-case-sensitivity.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* The `java/weak-cryptographic-algorithm` and `java/potentially-weak-cryptographic-algorithm` queries now match cryptographic algorithm names and modes case-insensitively (for example, `AES/CBC/PKCS5PADDING` and `AES/cbc/Pkcs5Padding`).
+* The `java/weak-cryptographic-algorithm`, `java/potentially-weak-cryptographic-algorithm`, and `java/rsa-without-oaep` queries now match cryptographic algorithm names and modes case-insensitively (for example, `AES/CBC/PKCS5PADDING` and `AES/cbc/Pkcs5Padding`).

java/ql/lib/semmle/code/java/security/RsaWithoutOaepQuery.qll

@@ -10,7 +10,7 @@ import semmle.code.java.dataflow.DataFlow
 module RsaWithoutOaepConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node src) {
     exists(CompileTimeConstantExpr specExpr, string spec |
-      specExpr.getStringValue() = spec and
+      specExpr.getStringValue().toUpperCase() = spec and
       specExpr = src.asExpr() and
       spec.matches("RSA/%") and
       not spec.matches("%OAEP%")

java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.expected

@@ -1,12 +1,14 @@
 #select
 | RsaWithoutOaepTest.java:5:44:5:62 | "RSA/ECB/NoPadding" | RsaWithoutOaepTest.java:5:44:5:62 | "RSA/ECB/NoPadding" | RsaWithoutOaepTest.java:5:44:5:62 | "RSA/ECB/NoPadding" | This specification is used to $@ without OAEP padding. | RsaWithoutOaepTest.java:5:44:5:62 | "RSA/ECB/NoPadding" | initialize an RSA cipher |
-| RsaWithoutOaepTest.java:15:32:15:50 | "RSA/ECB/NoPadding" : String | RsaWithoutOaepTest.java:15:32:15:50 | "RSA/ECB/NoPadding" : String | RsaWithoutOaepTest.java:11:35:11:38 | spec | This specification is used to $@ without OAEP padding. | RsaWithoutOaepTest.java:11:35:11:38 | spec | initialize an RSA cipher |
+| RsaWithoutOaepTest.java:6:49:6:67 | "rsa/ECB/NoPadding" | RsaWithoutOaepTest.java:6:49:6:67 | "rsa/ECB/NoPadding" | RsaWithoutOaepTest.java:6:49:6:67 | "rsa/ECB/NoPadding" | This specification is used to $@ without OAEP padding. | RsaWithoutOaepTest.java:6:49:6:67 | "rsa/ECB/NoPadding" | initialize an RSA cipher |
+| RsaWithoutOaepTest.java:17:32:17:50 | "RSA/ECB/NoPadding" : String | RsaWithoutOaepTest.java:17:32:17:50 | "RSA/ECB/NoPadding" : String | RsaWithoutOaepTest.java:13:35:13:38 | spec | This specification is used to $@ without OAEP padding. | RsaWithoutOaepTest.java:13:35:13:38 | spec | initialize an RSA cipher |
 edges
-| RsaWithoutOaepTest.java:10:29:10:39 | spec : String | RsaWithoutOaepTest.java:11:35:11:38 | spec | provenance |  |
-| RsaWithoutOaepTest.java:15:32:15:50 | "RSA/ECB/NoPadding" : String | RsaWithoutOaepTest.java:10:29:10:39 | spec : String | provenance |  |
+| RsaWithoutOaepTest.java:12:29:12:39 | spec : String | RsaWithoutOaepTest.java:13:35:13:38 | spec | provenance |  |
+| RsaWithoutOaepTest.java:17:32:17:50 | "RSA/ECB/NoPadding" : String | RsaWithoutOaepTest.java:12:29:12:39 | spec : String | provenance |  |
 nodes
 | RsaWithoutOaepTest.java:5:44:5:62 | "RSA/ECB/NoPadding" | semmle.label | "RSA/ECB/NoPadding" |
-| RsaWithoutOaepTest.java:10:29:10:39 | spec : String | semmle.label | spec : String |
-| RsaWithoutOaepTest.java:11:35:11:38 | spec | semmle.label | spec |
-| RsaWithoutOaepTest.java:15:32:15:50 | "RSA/ECB/NoPadding" : String | semmle.label | "RSA/ECB/NoPadding" : String |
+| RsaWithoutOaepTest.java:6:49:6:67 | "rsa/ECB/NoPadding" | semmle.label | "rsa/ECB/NoPadding" |
+| RsaWithoutOaepTest.java:12:29:12:39 | spec : String | semmle.label | spec : String |
+| RsaWithoutOaepTest.java:13:35:13:38 | spec | semmle.label | spec |
+| RsaWithoutOaepTest.java:17:32:17:50 | "RSA/ECB/NoPadding" : String | semmle.label | "RSA/ECB/NoPadding" : String |
 subpaths

java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.java

@@ -3,8 +3,10 @@
 class RsaWithoutOaep {
     public void test() throws Exception {
         Cipher rsaBad = Cipher.getInstance("RSA/ECB/NoPadding"); // $ Alert
+        Cipher rsaBadLower = Cipher.getInstance("rsa/ECB/NoPadding"); // $ Alert
 
         Cipher rsaGood = Cipher.getInstance("RSA/ECB/OAEPWithSHA-1AndMGF1Padding");
+        Cipher rsaGoodLower = Cipher.getInstance("rsa/ecb/oaepwithsha-1andmgf1padding");
     }
 
     public Cipher getCipher(String spec) throws Exception {