hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-17 15:33:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'amammad-java-JWT' of https://github.com/am0o0/codeql into amammad-java-JWT

Browse Source
This commit is contained in:
am0o0
2024-07-31 11:04:24 +02:00
parent c6814fcf47 8f52b2cd95
commit 9110df6e80
1 changed files with 5 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
java/ql/src/experimental/Security/CWE/CWE-347/Auth0NoVerifier.qhelp
View File

@@ -2,24 +2,21 @@
<qhelp>
<overview>
<p>
A JSON Web Token (JWT) is used for authenticating and managing users in an application.
</p>
<p>
Only Decoding JWTs without checking if they have a valid signature or not can lead to security vulnerabilities.
A JSON Web Token (JWT) is used for authenticating and managing users in an application. It must be verified in order to ensure the JWT is genuine.
</p>
</overview>
<recommendation>
<p>
Don't use methods that only decode JWT, Instead use methods that verify the signature of JWT.
Don't use information from a JWT without verifying that JWT.
</p>
</recommendation>
<example>
<p>
The following code you can see an Example from a popular Library.
The following example illustrates secure and insecure use of the Auth0 `java-jwt` library.
</p>
<sample src="Example.java" />
@@ -27,8 +24,8 @@
</example>
<references>
<li>
<a href="CVE-2021-37580">The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication.</a>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-37580">The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication.</a>
</li>
</references>
</qhelp>
</qhelp>