hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Factor common expr into class.

Browse Source
This commit is contained in:
intrigus
2021-04-22 23:51:27 +02:00
parent 958e2fab05
commit a385b30c29
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
java/ql/src/experimental/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql
View File

@@ -17,6 +17,11 @@ class TypeJwtParser extends Interface {
TypeJwtParser() { this.hasQualifiedName("io.jsonwebtoken", "JwtParser") }
}
/** The interface `io.jsonwebtoken.JwtParser` or a type derived from it. */
class TypeDerivedJwtParser extends RefType {
TypeDerivedJwtParser() { this.getASourceSupertype*() instanceof TypeJwtParser }
}
/** The interface `io.jsonwebtoken.JwtParserBuilder`. */
class TypeJwtParserBuilder extends Interface {
TypeJwtParserBuilder() { this.hasQualifiedName("io.jsonwebtoken", "JwtParserBuilder") }
@@ -122,7 +127,7 @@ private class JwtParserWithSigningKeyExpr extends Expr {
MethodAccess signingMa;
JwtParserWithSigningKeyExpr() {
this.getType().(RefType).getASourceSupertype*() instanceof TypeJwtParser and
this.getType() instanceof TypeDerivedJwtParser and
isSigningKeySetter(this, signingMa)
}
@@ -142,13 +147,13 @@ private class SigningToExprDataFlow extends DataFlow::Configuration {
}
override predicate isSink(DataFlow::Node sink) {
sink.asExpr().getType().(RefType).getASourceSupertype*() instanceof TypeJwtParser
sink.asExpr().getType() instanceof TypeDerivedJwtParser
}
/** Models the builder style of `JwtParser` and `JwtParserBuilder`. */
override predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
(
pred.asExpr().getType().(RefType).getASourceSupertype*() instanceof TypeJwtParser or
pred.asExpr().getType() instanceof TypeDerivedJwtParser or
pred.asExpr().getType().(RefType).getASourceSupertype*() instanceof TypeJwtParserBuilder
) and
succ.asExpr().(MethodAccess).getQualifier() = pred.asExpr()