Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit bc2370a

Browse files
atorralbaatorralba
committed
Use InlineExpectationsTest for tests
1 parent cfb38c4 commit bc2370a

6 files changed

Lines changed: 54 additions & 70 deletions

File tree

‎java/ql/test/query-tests/security/CWE-347/MissingJWTSignatureCheck.expected‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎java/ql/test/query-tests/security/CWE-347/MissingJWTSignatureCheck.qlref‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎java/ql/test/query-tests/security/CWE-347/MissingJWTSignatureCheckTest.expected‎

Whitespace-only changes.

java/ql/test/query-tests/security/CWE-347/MissingJWTSignatureCheck.java renamed to java/ql/test/query-tests/security/CWE-347/MissingJWTSignatureCheckTest.java

Lines changed: 34 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jwtk-jjwt-0.11.2
2-
31
import io.jsonwebtoken.Jwts;
42
import io.jsonwebtoken.JwtParser;
53
import io.jsonwebtoken.Jwt;
@@ -9,10 +7,7 @@
97
import io.jsonwebtoken.JwtHandlerAdapter;
108
import io.jsonwebtoken.impl.DefaultJwtParser;
119

12-
public class MissingJWTSignatureCheck {
13-
14-
15-
// SIGNED
10+
public class MissingJWTSignatureCheckTest {
1611

1712
private JwtParser getASignedParser() {
1813
return Jwts.parser().setSigningKey("someBase64EncodedKey");
@@ -46,10 +41,6 @@ private void callSignedParsers() {
4641
goodJwtHandler(parser3, "");
4742
}
4843

49-
// SIGNED END
50-
51-
// UNSIGNED
52-
5344
private JwtParser getAnUnsignedParser() {
5445
return Jwts.parser();
5546
}
@@ -84,81 +75,63 @@ private void callUnsignedParsers() {
8475

8576
private void signParserAfterParseCall() {
8677
JwtParser parser = getAnUnsignedParser();
87-
parser.parse(""); // Should not be detected
78+
parser.parse(""); // Safe
8879
parser.setSigningKey("someBase64EncodedKey");
8980
}
9081

91-
// UNSIGNED END
92-
93-
// INDIRECT
94-
9582
private void badJwtOnParserBuilder(JwtParser parser, String token) {
96-
parser.parse(token); // BAD: Does not verify the signature
83+
parser.parse(token); // $hasMissingJwtSignatureCheck
9784
}
9885

9986
private void badJwtHandlerOnParserBuilder(JwtParser parser, String token) {
100-
parser.parse(token, new JwtHandlerAdapter<Jwt<Header, String>>() { // BAD: The handler is called on an unverified JWT
101-
@Override
102-
public Jwt<Header, String> onPlaintextJwt(Jwt<Header, String> jwt) {
103-
return jwt;
104-
}
105-
});
87+
parser.parse(token, new JwtHandlerAdapter<Jwt<Header, String>>() { // $hasMissingJwtSignatureCheck
88+
@Override
89+
public Jwt<Header, String> onPlaintextJwt(Jwt<Header, String> jwt) {
90+
return jwt;
91+
}
92+
});
10693
}
10794

10895
private void goodJwtOnParserBuilder(JwtParser parser, String token) {
109-
parser.parseClaimsJws(token) // GOOD: Verify the signature
110-
.getBody();
96+
parser.parseClaimsJws(token) // Safe
97+
.getBody();
11198
}
11299

113100
private void goodJwtHandler(JwtParser parser, String token) {
114-
parser.parse(token, new JwtHandlerAdapter<Jws<String>>() { // GOOD: The handler is called on a verified JWS
115-
@Override
116-
public Jws<String> onPlaintextJws(Jws<String> jws) {
117-
return jws;
118-
}
119-
});
101+
parser.parse(token, new JwtHandlerAdapter<Jws<String>>() { // Safe
102+
@Override
103+
public Jws<String> onPlaintextJws(Jws<String> jws) {
104+
return jws;
105+
}
106+
});
120107
}
121108

122-
// INDIRECT END
123-
124-
// DIRECT
125-
126109
private void badJwtOnParserBuilder(String token) {
127-
Jwts.parserBuilder()
128-
.setSigningKey("someBase64EncodedKey").build()
129-
.parse(token); // BAD: Does not verify the signature
110+
Jwts.parserBuilder().setSigningKey("someBase64EncodedKey").build().parse(token); // $hasMissingJwtSignatureCheck
130111
}
131112

132113
private void badJwtHandlerOnParser(String token) {
133-
Jwts.parser()
134-
.setSigningKey("someBase64EncodedKey")
135-
.parse(token, new JwtHandlerAdapter<Jwt<Header, String>>() { // BAD: The handler is called on an unverified JWT
136-
@Override
137-
public Jwt<Header, String> onPlaintextJwt(Jwt<Header, String> jwt) {
138-
return jwt;
139-
}
140-
});
114+
Jwts.parser().setSigningKey("someBase64EncodedKey").parse(token, // $hasMissingJwtSignatureCheck
115+
new JwtHandlerAdapter<Jwt<Header, String>>() {
116+
@Override
117+
public Jwt<Header, String> onPlaintextJwt(Jwt<Header, String> jwt) {
118+
return jwt;
119+
}
120+
});
141121
}
142122

143123
private void goodJwtOnParser(String token) {
144-
Jwts.parser()
145-
.setSigningKey("someBase64EncodedKey")
146-
.parseClaimsJws(token) // GOOD: Verify the signature
147-
.getBody();
124+
Jwts.parser().setSigningKey("someBase64EncodedKey").parseClaimsJws(token) // Safe
125+
.getBody();
148126
}
149127

150128
private void goodJwtHandlerOnParserBuilder(String token) {
151-
Jwts.parserBuilder()
152-
.setSigningKey("someBase64EncodedKey").build()
153-
.parse(token, new JwtHandlerAdapter<Jws<String>>() { // GOOD: The handler is called on a verified JWS
154-
@Override
155-
public Jws<String> onPlaintextJws(Jws<String> jws) {
156-
return jws;
157-
}
158-
});
129+
Jwts.parserBuilder().setSigningKey("someBase64EncodedKey").build().parse(token, // Safe
130+
new JwtHandlerAdapter<Jws<String>>() {
131+
@Override
132+
public Jws<String> onPlaintextJws(Jws<String> jws) {
133+
return jws;
134+
}
135+
});
159136
}
160-
161-
// DIRECT END
162-
163-
164137
}

‎java/ql/test/query-tests/security/CWE-347/MissingJWTSignatureCheckTest.ql‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
import java
2+
import semmle.code.java.security.JWT
3+
import TestUtilities.InlineExpectationsTest
4+
5+
class HasMissingJwtSignatureCheckTest extends InlineExpectationsTest {
6+
HasMissingJwtSignatureCheckTest() { this = "HasMissingJwtSignatureCheckTest" }
7+
8+
override string getARelevantTag() { result = "hasMissingJwtSignatureCheck" }
9+
10+
override predicate hasActualResult(Location location, string element, string tag, string value) {
11+
tag = "hasMissingJwtSignatureCheck" and
12+
exists(JwtParserWithInsecureParseSink sink, JwtParserWithSigningKeyExpr parserExpr |
13+
sink.asExpr() = parserExpr and
14+
sink.getLocation() = location and
15+
element = sink.toString() and
16+
value = ""
17+
)
18+
}
19+
}

‎java/ql/test/query-tests/security/CWE-347/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jwtk-jjwt-0.11.2

0 commit comments

Comments
 (0)