hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply getItem(_) and extend verifiesSignature readability

Browse Source
This commit is contained in:
jorgectf
2021-10-28 17:40:27 +02:00
parent ef4a27ff8c
commit a6c285ad32
3 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/ql/src/experimental/semmle/python/libraries/Authlib.qll
View File

@@ -42,7 +42,7 @@ private module Authlib {
override DataFlow::Node getAlgorithm() {
exists(KeyValuePair headerDict |
headerDict = this.getArg(0).asExpr().(Dict).getItems().getAnItem() and
headerDict = this.getArg(0).asExpr().(Dict).getItem(_) and
headerDict.getKey().(Str_).getS().matches("alg") and
result.asExpr() = headerDict.getValue()
)

2
python/ql/src/experimental/semmle/python/libraries/PyJWT.qll
View File

@@ -101,7 +101,7 @@ private module PyJWT {
predicate hasVerifySignatureSetToFalse() {
exists(KeyValuePair optionsDict, NameConstant falseName |
falseName.getId() = "False" and
optionsDict = this.getOptions().asExpr().(Dict).getItems().getAnItem() and
optionsDict = this.getOptions().asExpr().(Dict).getItem(_) and
optionsDict.getKey().(Str_).getS().matches("%verify%") and
falseName = optionsDict.getValue()
)

12
python/ql/src/experimental/semmle/python/libraries/PythonJose.qll
View File

@@ -88,12 +88,18 @@ private module PythonJose {
override predicate verifiesSignature() {
// jwt.decode(token, "key", "HS256")
not exists(this.getOptions())
this.hasNoOptions()
or
// jwt.decode(token, key, options={"verify_signature": False})
not exists(KeyValuePair optionsDict, NameConstant falseName |
not this.hasVerifySignatureSetToFalse()
}
predicate hasNoOptions() { not exists(this.getOptions()) }
predicate hasVerifySignatureSetToFalse() {
exists(KeyValuePair optionsDict, NameConstant falseName |
falseName.getId() = "False" and
optionsDict = this.getOptions().asExpr().(Dict).getItems().getAnItem() and
optionsDict = this.getOptions().asExpr().(Dict).getItem(_) and
optionsDict.getKey().(Str_).getS().matches("%verify%") and
falseName = optionsDict.getValue()
)