|
| 1 | +private import python |
| 2 | +private import experimental.semmle.python.Concepts |
| 3 | +private import semmle.python.ApiGraphs |
| 4 | + |
| 5 | +private module Python_JWT { |
| 6 | + /** |
| 7 | + * Gets a call to `python_jwt.process_jwt`. |
| 8 | + * |
| 9 | + * Given the following example: |
| 10 | + * |
| 11 | + * ```py |
| 12 | + * python_jwt.process_jwt(token) |
| 13 | + * python_jwt.verify_jwt(token, "key", "HS256") |
| 14 | + * ``` |
| 15 | + * |
| 16 | + * * `this` would be `jwt.process_jwt(token)`. |
| 17 | + * * `getPayload()`'s result would be `token`. |
| 18 | + * * `getKey()`'s result would be `"key"`. |
| 19 | + * * `getAlgorithm()`'s result would be `"HS256"`. |
| 20 | + * * `getAlgorithmstring()`'s result would be `HS256`. |
| 21 | + * * `getOptions()`'s result would be `none()`. |
| 22 | + * * `verifiesSignature()` predicate would succeed. |
| 23 | + */ |
| 24 | + private class Python_JWTProcessCall extends DataFlow::CallCfgNode, JWTDecoding::Range { |
| 25 | + DataFlow::CallCfgNode verifyCall; |
| 26 | + boolean verifiesSignature; |
| 27 | + |
| 28 | + Python_JWTProcessCall() { |
| 29 | + this = API::moduleImport("python_jwt").getMember("process_jwt").getACall() and |
| 30 | + ( |
| 31 | + verifyCall = API::moduleImport("python_jwt").getMember("verify_jwt").getACall() and |
| 32 | + this.getArg(0).getALocalSource().flowsTo(verifyCall.getArg(0)) and |
| 33 | + verifiesSignature = true |
| 34 | + or |
| 35 | + verifiesSignature = false |
| 36 | + ) |
| 37 | + } |
| 38 | + |
| 39 | + override DataFlow::Node getPayload() { result = this.getArg(0) } |
| 40 | + |
| 41 | + override DataFlow::Node getKey() { result = verifyCall.getArg(1) } |
| 42 | + |
| 43 | + override DataFlow::Node getAlgorithm() { result = verifyCall.getArg(2) } |
| 44 | + |
| 45 | + override string getAlgorithmString() { |
| 46 | + exists(StrConst str | |
| 47 | + DataFlow::exprNode(str).(DataFlow::LocalSourceNode).flowsTo(this.getAlgorithm()) and |
| 48 | + result = str.getText() |
| 49 | + ) |
| 50 | + } |
| 51 | + |
| 52 | + override DataFlow::Node getOptions() { none() } |
| 53 | + |
| 54 | + override predicate verifiesSignature() { exists( | verifiesSignature = true) } |
| 55 | + } |
| 56 | +} |
0 commit comments