hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 03:06:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Plural type name -> singular type name.

Browse Source
This commit is contained in:
intrigus
2021-04-20 23:09:44 +02:00
parent 3acec94773
commit fcaf5e7657
1 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
java/ql/src/experimental/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql
View File

@@ -42,8 +42,8 @@ private class JwtParserParseHandlerMethod extends Method {
} }
/** The `parse(token)`, `parseClaimsJwt(token)` and `parsePlaintextJwt(token)` methods defined in `JwtParser`. */ /** The `parse(token)`, `parseClaimsJwt(token)` and `parsePlaintextJwt(token)` methods defined in `JwtParser`. */
private class JwtParserInsecureParseMethods extends Method { private class JwtParserInsecureParseMethod extends Method {
JwtParserInsecureParseMethods() { JwtParserInsecureParseMethod() {
this.hasName(["parse", "parseClaimsJwt", "parsePlaintextJwt"]) and this.hasName(["parse", "parseClaimsJwt", "parsePlaintextJwt"]) and
this.getNumberOfParameters() = 1 and this.getNumberOfParameters() = 1 and
this.getDeclaringType() instanceof TypeJwtParser this.getDeclaringType() instanceof TypeJwtParser
@@ -51,8 +51,8 @@ private class JwtParserInsecureParseMethods extends Method {
} }
/** The `on(Claims|Plaintext)Jwt` methods defined in `JwtHandler`. */ /** The `on(Claims|Plaintext)Jwt` methods defined in `JwtHandler`. */
private class JwtHandlerOnJwtMethods extends Method { private class JwtHandlerOnJwtMethod extends Method {
JwtHandlerOnJwtMethods() { JwtHandlerOnJwtMethod() {
this.hasName(["onClaimsJwt", "onPlaintextJwt"]) and this.hasName(["onClaimsJwt", "onPlaintextJwt"]) and
this.getNumberOfParameters() = 1 and this.getNumberOfParameters() = 1 and
this.getDeclaringType() instanceof TypeJwtHandler this.getDeclaringType() instanceof TypeJwtHandler
@@ -60,8 +60,8 @@ private class JwtHandlerOnJwtMethods extends Method {
} }
/** The `on(Claims|Plaintext)Jwt` methods defined in `JwtHandlerAdapter`. */ /** The `on(Claims|Plaintext)Jwt` methods defined in `JwtHandlerAdapter`. */
private class JwtHandlerAdapterOnJwtMethods extends Method { private class JwtHandlerAdapterOnJwtMethod extends Method {
JwtHandlerAdapterOnJwtMethods() { JwtHandlerAdapterOnJwtMethod() {
this.hasName(["onClaimsJwt", "onPlaintextJwt"]) and this.hasName(["onClaimsJwt", "onPlaintextJwt"]) and
this.getNumberOfParameters() = 1 and this.getNumberOfParameters() = 1 and
this.getDeclaringType() instanceof TypeJwtHandlerAdapter this.getDeclaringType() instanceof TypeJwtHandlerAdapter
@@ -70,8 +70,8 @@ private class JwtHandlerAdapterOnJwtMethods extends Method {
/** /**
* Holds if `parseHandlerExpr` is an insecure `JwtHandler`. * Holds if `parseHandlerExpr` is an insecure `JwtHandler`.
* That is, it overrides a method from `JwtHandlerOnJwtMethods` and the overridden method is not a method from `JwtHandlerAdapterOnJwtMethods`. * That is, it overrides a method from `JwtHandlerOnJwtMethod` and the overridden method is not a method from `JwtHandlerAdapterOnJwtMethod`.
* A overridden method which is a method from `JwtHandlerAdapterOnJwtMethods` is safe, because these always throw an exception. * A overridden method which is a method from `JwtHandlerAdapterOnJwtMethod` is safe, because these always throw an exception.
*/ */
private predicate isInsecureParseHandler(Expr parseHandlerExpr) { private predicate isInsecureParseHandler(Expr parseHandlerExpr) {
exists(RefType t | exists(RefType t |
@@ -79,8 +79,8 @@ private predicate isInsecureParseHandler(Expr parseHandlerExpr) {
t.getASourceSupertype*() instanceof TypeJwtHandler and t.getASourceSupertype*() instanceof TypeJwtHandler and
exists(Method m | exists(Method m |
m = t.getAMethod() and m = t.getAMethod() and
m.getASourceOverriddenMethod+() instanceof JwtHandlerOnJwtMethods and m.getASourceOverriddenMethod+() instanceof JwtHandlerOnJwtMethod and
not m.getSourceDeclaration() instanceof JwtHandlerAdapterOnJwtMethods not m.getSourceDeclaration() instanceof JwtHandlerAdapterOnJwtMethod
) )
) )
} }
@@ -92,7 +92,7 @@ private predicate isInsecureParseHandler(Expr parseHandlerExpr) {
*/ */
private class JwtParserInsecureParseMethodAccess extends MethodAccess { private class JwtParserInsecureParseMethodAccess extends MethodAccess {
JwtParserInsecureParseMethodAccess() { JwtParserInsecureParseMethodAccess() {
this.getMethod().getASourceOverriddenMethod*() instanceof JwtParserInsecureParseMethods this.getMethod().getASourceOverriddenMethod*() instanceof JwtParserInsecureParseMethod
or or
this.getMethod().getASourceOverriddenMethod*() instanceof JwtParserParseHandlerMethod and this.getMethod().getASourceOverriddenMethod*() instanceof JwtParserParseHandlerMethod and
isInsecureParseHandler(this.getArgument(1)) isInsecureParseHandler(this.getArgument(1))