hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source
This commit is contained in:
Tony Torralba
2021-08-04 13:15:49 +02:00
parent 452fd9a8e3
commit a046d75ea6
4 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql
View File

@@ -1,6 +1,6 @@
/**
* @name Missing JWT signature check
* @description Failing to check the JWT signature may allow an attacker to forge their own tokens.
* @description Failing to check the Json Web Token (JWT) signature may allow an attacker to forge their own tokens.
* @kind path-problem
* @problem.severity error
* @security-severity 7.8

1
java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -97,7 +97,6 @@ private module Frameworks {
private import semmle.code.java.security.ResponseSplitting
private import semmle.code.java.security.InformationLeak
private import semmle.code.java.security.JexlInjectionSinkModels
private import semmle.code.java.security.JWT
private import semmle.code.java.security.LdapInjection
private import semmle.code.java.security.XPath
private import semmle.code.java.frameworks.android.SQLite

2
java/ql/src/semmle/code/java/security/JWT.qll
View File

@@ -1,4 +1,4 @@
/** Provides classes for working with JWT libraries. */
/** Provides classes for working with JSON Web Token (JWT) libraries. */
import java
private import semmle.code.java.dataflow.ExternalFlow

3
java/ql/src/semmle/code/java/security/MissingJWTSignatureCheckQuery.qll
View File

@@ -1,8 +1,7 @@
/** Provides classes to be used in queries related to JWT signature vulnerabilities. */
/** Provides classes to be used in queries related to JSON Web Token (JWT) signature vulnerabilities. */
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.ExternalFlow
import semmle.code.java.security.JWT
/**