hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Model python_jwt.process_jwt

Browse Source
This commit is contained in:
jorgectf
2021-12-19 18:32:14 +01:00
parent 8fabbd697e
commit f82ed8573e
4 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
python/ql/test/experimental/query-tests/Security/CWE-347/JWTMissingSecretOrPublicKeyVerification.expected
View File

@@ -1,3 +1,4 @@
| pyjwt.py:22:12:22:16 | ControlFlowNode for token | is not verified with a cryptographic secret or public key. |
| pyjwt.py:23:12:23:16 | ControlFlowNode for token | is not verified with a cryptographic secret or public key. |
| python_jose.py:19:12:19:16 | ControlFlowNode for token | is not verified with a cryptographic secret or public key. |
| python_jwt.py:14:24:14:29 | ControlFlowNode for token3 | is not verified with a cryptographic secret or public key. |

14
python/ql/test/experimental/query-tests/Security/CWE-347/python_jwt.py Normal file
View File

@@ -0,0 +1,14 @@
import python_jwt
# GOOD
token1 = "1"
python_jwt.process_jwt(token1)
python_jwt.verify_jwt(token1, "key", "HS256")
# BAD
# no call to verify_jwt
token3 = "123"
python_jwt.process_jwt(token3)