[jrepucci-rh]

Description

Added Node.js Crypto rules for Diffie-Hellman key exchanges.

AI Generated by: Claude (using Opus 5)

Type of change

• New rule(s)
• New / updated test fixtures
• Bug fix (false positive / false negative)
• Test framework or tooling
• Documentation

Checklist

• New / changed rules have matching test fixtures
• make test passes locally
• Rule files validate with opengrep --validate
• Commits follow Conventional Commits
• No private or internal data is included in this change

Notes for reviewers

Header comments in these files were written by AI and likely inaccurate. View them as notes for the reviewer that may point to blind spots in the patterns. Take them with a grain of salt.

[isasmendiagus]

Thanks, this looks good. One fix before merging, see the inline comment.

Also, the title says "diffiehellman" but finite-field DH is not covered. Could you rename it to "ECDH, X25519 and X448"? DH can be a follow-up.

[isasmendiagus]

This matches any assignment that mentions $ECDH, not only a copy of it. That's what causes the { ec, ff } false positive from #7.

Suggestion: replace it with two patterns, $ECDH2 = $ECDH and $ECDH2 = $ECDH.$M(...). I tested it: the chained case still works, your four false positives go away, and the existing fixtures pass. Same on lines 87, 108 and 118.

Please also add the alias case and one negative to the fixture.

[jrepucci-rh]

Hey @isasmendiagus could you point me to the functions/objects that invoke finite field Diffiehellman? I thought I was covering every major Diffiehellman fucntion in the crypto library.

[jrepucci-rh]

@isasmendiagus Comments addressed. Lots of new test files, as in order to catch these new aliases I need a new file per test. Let me know if anything more is needed!

[isasmendiagus]

LGTM, thanks for the extra fixtures.

On your question: I read "diffiehellman" as the finite-field algorithm (createDiffieHellman(), getDiffieHellman(), and diffieHellman() over 'dh' keys), which your rules leave out on purpose. You meant the crypto.diffieHellman() function, which is covered. So nothing is missing, just the title could say "ECDH, X25519 and X448". Not blocking.