rename verifies() to verifiesSignature()

This commit is contained in:
Maiky
2023-09-15 11:45:19 +02:00
parent c43d0866f6
commit 15b965bb3b
3 changed files with 4 additions and 4 deletions

View File

@@ -1311,7 +1311,7 @@ class JwtDecoding extends DataFlow::Node instanceof JwtDecoding::Range {
DataFlow::Node getOptions() { result = super.getOptions() }
/** Checks if the signature gets verified while decoding. */
predicate verifies() { super.verifies() }
predicate verifiesSignature() { super.verifiesSignature() }
}
/** Provides a class for modeling new Jwt token encoding APIs. */
@@ -1336,6 +1336,6 @@ module JwtDecoding {
abstract DataFlow::Node getOptions();
/** Checks if the signature gets verified while decoding. */
abstract predicate verifies();
abstract predicate verifiesSignature();
}
}

View File

@@ -45,7 +45,7 @@ module Jwt {
override DataFlow::Node getOptions() { result = this.getArgument(3) }
override predicate verifies() {
override predicate verifiesSignature() {
not this.getArgument(2).getConstantValue().isBoolean(false) and
not this.getAlgorithm().getConstantValue().isStringlikeValue("none")
or

View File

@@ -12,5 +12,5 @@
private import codeql.ruby.Concepts
from JwtDecoding jwtDecoding
where not jwtDecoding.verifies()
where not jwtDecoding.verifiesSignature()
select jwtDecoding.getPayload(), "is not verified with a cryptographic secret or public key."