diff --git a/java/ql/src/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql b/java/ql/src/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql index 077d7a67370..6645e6c54ec 100644 --- a/java/ql/src/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql +++ b/java/ql/src/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql @@ -16,5 +16,5 @@ import MissingJwtSignatureCheckFlow::PathGraph from MissingJwtSignatureCheckFlow::PathNode source, MissingJwtSignatureCheckFlow::PathNode sink where MissingJwtSignatureCheckFlow::flowPath(source, sink) -select sink.getNode(), source, sink, "This parses a $@, but the signature is not verified.", +select sink.getNode(), source, sink, "This sets a $@, but the signature is not verified.", source.getNode(), "JWT signing key"