-
Notifications
You must be signed in to change notification settings - Fork 2k
Expand file tree
/
Copy pathJwt.qll
More file actions
57 lines (46 loc) · 1.95 KB
/
Jwt.qll
File metadata and controls
57 lines (46 loc) · 1.95 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
/**
* Provides classes and predicates for working with the `github.com/golang-jwt/jwt` and
* `github.com/dgrijalva/jwt-go` packages.
*/
import go
private import semmle.go.security.MissingJwtSignatureCheckCustomizations::MissingJwtSignatureCheck
/** The function `jwt.Parse` or the method `Parser.Parse`. */
private class GolangJwtParse extends JwtSafeParse {
GolangJwtParse() {
this.hasQualifiedName(golangJwtPackage(), "Parse")
or
this.(Method).hasQualifiedName(golangJwtPackage(), "Parser", "Parse")
}
override int getTokenArgNum() { result = 0 }
}
/** The function `jwt.ParseWithClaims` or the method `Parser.ParseWithClaims`. */
private class GolangJwtParseWithClaims extends JwtSafeParse {
GolangJwtParseWithClaims() {
this.hasQualifiedName(golangJwtPackage(), "ParseWithClaims")
or
this.(Method).hasQualifiedName(golangJwtPackage(), "Parser", "ParseWithClaims")
}
override int getTokenArgNum() { result = 0 }
}
/** The function `jwt.ParseFromRequest`. */
private class GolangJwtParseFromRequest extends JwtSafeParse {
GolangJwtParseFromRequest() {
this.hasQualifiedName(golangJwtRequestPackage(), "ParseFromRequest")
}
override int getTokenArgNum() { result = 0 }
}
/** The function `jwt.ParseFromRequestWithClaims`. */
private class GolangJwtParseFromRequestWithClaims extends JwtSafeParse {
GolangJwtParseFromRequestWithClaims() {
this.hasQualifiedName(golangJwtRequestPackage(), "ParseFromRequestWithClaims")
}
override int getTokenArgNum() { result = 0 }
}
/** Gets the pakcage names `github.com/golang-jwt/jwt` and `github.com/dgrijalva/jwt-go`. */
private string golangJwtPackage() {
result = package(["github.com/golang-jwt/jwt", "github.com/dgrijalva/jwt-go"], "")
}
/** Gets the package names `github.com/golang-jwt/jwt/request` and `github.com/dgrijalva/jwt-go/request`. */
private string golangJwtRequestPackage() {
result = package(["github.com/golang-jwt/jwt", "github.com/dgrijalva/jwt-go"], "request")
}