Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f1b3c70

Browse files
jorgectfjorgectf
committed
Divide JWT libraries
1 parent 3d2b6f7 commit f1b3c70

3 files changed

Lines changed: 77 additions & 70 deletions

File tree

‎python/ql/src/experimental/semmle/python/Frameworks.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,6 @@
55
private import experimental.semmle.python.frameworks.Stdlib
66
private import experimental.semmle.python.frameworks.LDAP
77
private import experimental.semmle.python.frameworks.JWT
8+
private import experimental.semmle.python.libraries.PyJWT
9+
private import experimental.semmle.python.libraries.Authlib
10+
private import experimental.semmle.python.libraries.PythonJose

‎python/ql/src/experimental/semmle/python/frameworks/JWT.qll‎

Lines changed: 0 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
private import python
2-
private import experimental.semmle.python.Concepts
32
private import semmle.python.ApiGraphs
43

54
predicate isEmptyOrNone(DataFlow::Node arg) { isEmpty(arg) or isNone(arg) }
@@ -19,72 +18,3 @@ predicate isFalse(DataFlow::Node arg) {
1918
exists( | DataFlow::exprNode(any(False falseExpr)).(DataFlow::LocalSourceNode).flowsTo(arg))
2019
}
2120

22-
private module JWT {
23-
/** Gets a reference to `jwt` */
24-
private API::Node pyjwt() { result = API::moduleImport("jwt") }
25-
26-
/** Gets a reference to `jwt.encode` */
27-
private API::Node pyjwt_encode() { result = pyjwt().getMember("encode") }
28-
29-
/** Gets a reference to `jwt.decode` */
30-
private API::Node pyjwt_decode() { result = pyjwt().getMember("decode") }
31-
32-
private class PyJWTEncodeCall extends DataFlow::CallCfgNode, JWTEncoding::Range {
33-
PyJWTEncodeCall() { this = pyjwt_encode().getACall() }
34-
35-
override DataFlow::Node getPayload() {
36-
result in [this.getArg(0), this.getArgByName("payload")]
37-
}
38-
39-
override DataFlow::Node getKey() { result in [this.getArg(1), this.getArgByName("key")] }
40-
41-
override DataFlow::Node getAlgorithm() {
42-
result in [this.getArg(2), this.getArgByName("algorithm")]
43-
}
44-
45-
override string getAlgorithmString() {
46-
exists(StrConst str |
47-
DataFlow::exprNode(str).(DataFlow::LocalSourceNode).flowsTo(getAlgorithm()) and
48-
result = str.getText()
49-
)
50-
}
51-
}
52-
53-
private class PyJWTDecodeCall extends DataFlow::CallCfgNode, JWTDecoding::Range {
54-
PyJWTDecodeCall() { this = pyjwt_decode().getACall() }
55-
56-
override DataFlow::Node getPayload() { result in [this.getArg(0), this.getArgByName("jwt")] }
57-
58-
override DataFlow::Node getKey() { result in [this.getArg(1), this.getArgByName("key")] }
59-
60-
override DataFlow::Node getAlgorithm() {
61-
result in [this.getArg(2), this.getArgByName("algorithms")]
62-
}
63-
64-
override string getAlgorithmString() {
65-
exists(StrConst str |
66-
DataFlow::exprNode(str).(DataFlow::LocalSourceNode).flowsTo(getAlgorithm()) and
67-
result = str.getText()
68-
)
69-
}
70-
71-
override DataFlow::Node getOptions() {
72-
result in [this.getArg(3), this.getArgByName("options")]
73-
}
74-
75-
override predicate verifiesSignature() {
76-
// jwt.decode(token, "key", "HS256")
77-
not exists(this.getArgByName("verify")) and not exists(this.getOptions())
78-
or
79-
// jwt.decode(token, verify=False)
80-
not isFalse(this.getArgByName("verify")) and
81-
// jwt.decode(token, key, options={"verify_signature": False})
82-
not exists(KeyValuePair optionsDict, NameConstant falseName |
83-
falseName.getId() = "False" and
84-
optionsDict = this.getArgByName("options").asExpr().(Dict).getItems().getAnItem() and
85-
optionsDict.getKey().(Str_).getS().matches("%verify%") and
86-
falseName = optionsDict.getValue()
87-
)
88-
}
89-
}
90-
}

‎python/ql/src/experimental/semmle/python/libraries/PyJWT.qll‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
private import python
2+
private import experimental.semmle.python.Concepts
3+
private import semmle.python.ApiGraphs
4+
private import experimental.semmle.python.frameworks.JWT
5+
6+
private module PyJWT {
7+
/** Gets a reference to `jwt` */
8+
private API::Node pyjwt() { result = API::moduleImport("jwt") }
9+
10+
/** Gets a reference to `jwt.encode` */
11+
private API::Node pyjwtEncode() { result = pyjwt().getMember("encode") }
12+
13+
/** Gets a reference to `jwt.decode` */
14+
private API::Node pyjwtDecode() { result = pyjwt().getMember("decode") }
15+
16+
private class PyJWTEncodeCall extends DataFlow::CallCfgNode, JWTEncoding::Range {
17+
PyJWTEncodeCall() { this = pyjwtEncode().getACall() }
18+
19+
override DataFlow::Node getPayload() {
20+
result in [this.getArg(0), this.getArgByName("payload")]
21+
}
22+
23+
override DataFlow::Node getKey() { result in [this.getArg(1), this.getArgByName("key")] }
24+
25+
override DataFlow::Node getAlgorithm() {
26+
result in [this.getArg(2), this.getArgByName("algorithm")]
27+
}
28+
29+
override string getAlgorithmString() {
30+
exists(StrConst str |
31+
DataFlow::exprNode(str).(DataFlow::LocalSourceNode).flowsTo(getAlgorithm()) and
32+
result = str.getText()
33+
)
34+
}
35+
}
36+
37+
private class PyJWTDecodeCall extends DataFlow::CallCfgNode, JWTDecoding::Range {
38+
PyJWTDecodeCall() { this = pyjwtDecode().getACall() }
39+
40+
override DataFlow::Node getPayload() { result in [this.getArg(0), this.getArgByName("jwt")] }
41+
42+
override DataFlow::Node getKey() { result in [this.getArg(1), this.getArgByName("key")] }
43+
44+
override DataFlow::Node getAlgorithm() {
45+
result in [this.getArg(2), this.getArgByName("algorithms")]
46+
}
47+
48+
override string getAlgorithmString() {
49+
exists(StrConst str |
50+
DataFlow::exprNode(str).(DataFlow::LocalSourceNode).flowsTo(getAlgorithm()) and
51+
result = str.getText()
52+
)
53+
}
54+
55+
override DataFlow::Node getOptions() {
56+
result in [this.getArg(3), this.getArgByName("options")]
57+
}
58+
59+
override predicate verifiesSignature() {
60+
// jwt.decode(token, "key", "HS256")
61+
not exists(this.getArgByName("verify")) and not exists(this.getOptions())
62+
or
63+
// jwt.decode(token, verify=False)
64+
not isFalse(this.getArgByName("verify")) and
65+
// jwt.decode(token, key, options={"verify_signature": False})
66+
not exists(KeyValuePair optionsDict, NameConstant falseName |
67+
falseName.getId() = "False" and
68+
optionsDict = this.getOptions().asExpr().(Dict).getItems().getAnItem() and
69+
optionsDict.getKey().(Str_).getS().matches("%verify%") and
70+
falseName = optionsDict.getValue()
71+
)
72+
}
73+
}
74+
}

0 commit comments

Comments
 (0)