hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Convert hardcoded-jwt-key models to data extensions.

Browse Source
This commit is contained in:
Michael Nebel
2022-11-22 09:58:45 +01:00
parent ab12b6cc2b
commit 07578f11d4
2 changed files with 23 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
java/ql/src/experimental/Security/CWE/CWE-321/HardcodedJwtKey.qll
View File

@@ -6,6 +6,10 @@ import java
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSources
private class ActivateModels extends ActiveExperimentalModels {
ActivateModels() { this = "hardcoded-jwt-key" }
}
/** The class `com.auth0.jwt.JWT`. */
class Jwt extends RefType {
Jwt() { this.hasQualifiedName("com.auth0.jwt", "JWT") }
@@ -125,21 +129,3 @@ class HardcodedJwtKeyConfiguration extends TaintTracking::Configuration {
)
}
}
/** Taint model related to verifying JWT tokens. */
private class VerificationFlowStep extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"com.auth0.jwt.interfaces;Verification;true;build;;;Argument[-1];ReturnValue;taint;manual",
"com.auth0.jwt.interfaces;Verification;true;" +
["acceptLeeway", "acceptExpiresAt", "acceptNotBefore", "acceptIssuedAt", "ignoreIssuedAt"]
+ ";;;Argument[-1];ReturnValue;value;manual",
"com.auth0.jwt.interfaces;Verification;true;with" +
[
"Issuer", "Subject", "Audience", "AnyOfAudience", "ClaimPresence", "Claim",
"ArrayClaim", "JWTId"
] + ";;;Argument[-1];ReturnValue;value;manual"
]
}
}