From d290e2f037815f6c2775ea3af5a9bfe1b9755797 Mon Sep 17 00:00:00 2001
From: jketema <93738568+jketema@users.noreply.github.com>
Date: Fri, 16 Oct 2026 14:11:09 +0000
Subject: [PATCH] Java/Ruby: Replace recursive algorithm string builders

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../semmle/code/java/security/Encryption.qll  | 10 +++-------
 .../quantum/Examples/BrokenCrypto.ql          | 10 +++-------
 ruby/ql/lib/codeql/ruby/security/OpenSSL.qll  | 20 ++++++-------------
 3 files changed, 12 insertions(+), 28 deletions(-)

diff --git a/java/ql/lib/semmle/code/java/security/Encryption.qll b/java/ql/lib/semmle/code/java/security/Encryption.qll
index 6af8d29cc4a1..f4e218c981e6 100644
--- a/java/ql/lib/semmle/code/java/security/Encryption.qll
+++ b/java/ql/lib/semmle/code/java/security/Encryption.qll
@@ -271,19 +271,15 @@ string getASecureAlgorithmName() {
 
 private string rankedSecureAlgorithm(int i) { result = rank[i](getASecureAlgorithmName()) }
 
-private string secureAlgorithmString(int i) {
-  i = 1 and result = rankedSecureAlgorithm(i)
-  or
-  result = rankedSecureAlgorithm(i) + "|" + secureAlgorithmString(i - 1)
+private string secureAlgorithmString() {
+  result = concat(int i | | rankedSecureAlgorithm(i), "|" order by i desc)
 }
 
 /**
  * Gets a regular expression for matching strings that look like they
  * contain an algorithm that is known to be secure.
  */
-string getSecureAlgorithmRegex() {
-  result = algorithmRegex(secureAlgorithmString(max(int i | exists(rankedSecureAlgorithm(i)))))
-}
+string getSecureAlgorithmRegex() { result = algorithmRegex(secureAlgorithmString()) }
 
 /**
  * Any use of a cryptographic element that specifies an encryption
diff --git a/java/ql/src/experimental/quantum/Examples/BrokenCrypto.ql b/java/ql/src/experimental/quantum/Examples/BrokenCrypto.ql
index b449f118bc34..a4215caac6a5 100644
--- a/java/ql/src/experimental/quantum/Examples/BrokenCrypto.ql
+++ b/java/ql/src/experimental/quantum/Examples/BrokenCrypto.ql
@@ -34,19 +34,15 @@ private string rankedInsecureAlgorithm(int i) {
   result = rank[i](string s | s = getAnInsecureAlgorithmName())
 }
 
-private string insecureAlgorithmString(int i) {
-  i = 1 and result = rankedInsecureAlgorithm(i)
-  or
-  result = rankedInsecureAlgorithm(i) + "|" + insecureAlgorithmString(i - 1)
+private string insecureAlgorithmString() {
+  result = concat(int i | | rankedInsecureAlgorithm(i), "|" order by i desc)
 }
 
 /**
  * Gets the regular expression used for matching strings that look like they
  * contain an algorithm that is known to be insecure.
  */
-string getInsecureAlgorithmRegex() {
-  result = algorithmRegex(insecureAlgorithmString(max(int i | exists(rankedInsecureAlgorithm(i)))))
-}
+string getInsecureAlgorithmRegex() { result = algorithmRegex(insecureAlgorithmString()) }
 
 bindingset[algorithmString]
 private string algorithmRegex(string algorithmString) {
diff --git a/ruby/ql/lib/codeql/ruby/security/OpenSSL.qll b/ruby/ql/lib/codeql/ruby/security/OpenSSL.qll
index 40b3ac036cc1..ca9b09cb3223 100644
--- a/ruby/ql/lib/codeql/ruby/security/OpenSSL.qll
+++ b/ruby/ql/lib/codeql/ruby/security/OpenSSL.qll
@@ -35,37 +35,29 @@ private string rankedInsecureAlgorithm(int i) {
     )
 }
 
-private string insecureAlgorithmString(int i) {
-  i = 1 and result = rankedInsecureAlgorithm(i)
-  or
-  result = rankedInsecureAlgorithm(i) + "|" + insecureAlgorithmString(i - 1)
+private string insecureAlgorithmString() {
+  result = concat(int i | | rankedInsecureAlgorithm(i), "|" order by i desc)
 }
 
 /**
  * Gets the regular expression used for matching strings that look like they
  * contain an algorithm that is known to be insecure.
  */
-private string getInsecureAlgorithmRegex() {
-  result = algorithmRegex(insecureAlgorithmString(max(int i | exists(rankedInsecureAlgorithm(i)))))
-}
+private string getInsecureAlgorithmRegex() { result = algorithmRegex(insecureAlgorithmString()) }
 
 private string rankedSecureAlgorithm(int i) {
   result = rank[i](string s | isStrongEncryptionAlgorithm(s))
 }
 
-private string secureAlgorithmString(int i) {
-  i = 1 and result = rankedSecureAlgorithm(i)
-  or
-  result = rankedSecureAlgorithm(i) + "|" + secureAlgorithmString(i - 1)
+private string secureAlgorithmString() {
+  result = concat(int i | | rankedSecureAlgorithm(i), "|" order by i desc)
 }
 
 /**
  * Gets a regular expression for matching strings that look like they
  * contain an algorithm that is known to be secure.
  */
-string getSecureAlgorithmRegex() {
-  result = algorithmRegex(secureAlgorithmString(max(int i | exists(rankedSecureAlgorithm(i)))))
-}
+string getSecureAlgorithmRegex() { result = algorithmRegex(secureAlgorithmString()) }
 
 /**
  * Names of known ciphers supported by the Ruby `OpenSSL` library, and