hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Ignore results in test directories.

Browse Source
This commit is contained in:
intrigus
2021-04-20 23:25:13 +02:00
parent fcaf5e7657
commit 231b07795c
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
java/ql/src/experimental/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql
View File

@@ -171,7 +171,21 @@ private class SigningKeyMethodAccess extends MethodAccess {
}
}
/**
* Holds if the `MethodAccess` `ma` occurs in a test file. A test file is any file that
* is a direct or indirect child of a directory named `test`, ignoring case.
*/
private predicate isInTestFile(MethodAccess ma) {
exists(string lowerCasedAbsolutePath |
lowerCasedAbsolutePath = ma.getLocation().getFile().getAbsolutePath().toLowerCase()
|
lowerCasedAbsolutePath.matches("%/test/%") and
not lowerCasedAbsolutePath
.matches("%/ql/test/experimental/query-tests/security/CWE-347/%".toLowerCase())
)
}
from JwtParserInsecureParseMethodAccess ma, JwtParserWithSigningKeyExpr parserExpr
where ma.getQualifier() = parserExpr
where ma.getQualifier() = parserExpr and not isInTestFile(ma)
select ma, "A signing key is set $@, but the signature is not verified.",
parserExpr.getSigningMethodAccess(), "here"