hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 05:05:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

More test cases for io.jsonwebtoken.SigningKeyResolverAdapter

Browse Source
This commit is contained in:
Ed Minnix
2023-04-20 14:58:06 -04:00
parent a4fa1ec768
commit 5c10d42915
1 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
java/ql/test/library-tests/dataflow/taintsources/JwsSigningKeyResolverAdapter.java
View File

@@ -1,3 +1,5 @@
import java.security.Key;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.JwsHeader;
import io.jsonwebtoken.SigningKeyResolverAdapter;
@@ -7,10 +9,25 @@ public class JwsSigningKeyResolverAdapter extends SigningKeyResolverAdapter {
}
@Override
public byte[] resolveSigningKeyBytes(JwsHeader header, Claims claims) {
public Key resolveSigningKey(JwsHeader header, Claims claims) {
final String keyId = header.getKeyId();
String example = "example:" + keyId;
sink(example); // $ hasRemoteTaintFlow
return null;
}
@Override
public byte[] resolveSigningKeyBytes(JwsHeader header, Claims claims) {
final String keyId = header.getKeyId();
String example = "example:" + keyId;
sink(example); // $ hasRemoteTaintFlow
final String algorithm = header.getAlgorithm();
sink("algo:" + algorithm); // $ hasRemoteTaintFlow
final String random = (String)header.get("random");
sink("random:" + random) ; // $ hasRemoteTaintFlow
return new byte[0];
}