Skip to content

Commit d40569d

Browse files
Apply suggestions from code review
Co-authored-by: kingthorin <[email protected]>
1 parent 575db9c commit d40569d

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

src/main/resources/org/zaproxy/zap/extension/jwt/resources/Messages.properties

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ jwt.scanner.server.vulnerability.signatureAttack.jwkCustomKey.desc=JWT library i
8484
jwt.scanner.server.vulnerability.signatureAttack.jwkCustomKey.refs=https://nvd.nist.gov/vuln/detail/CVE-2018-0114
8585
jwt.scanner.server.vulnerability.signatureAttack.jwkCustomKey.soln=Validating Library should not depend on user provided input
8686

87-
jwt.scanner.server.vulnerability.signatureAttack.publiclyKnownSecrets.name=Publicly well known HMac secret attack
87+
jwt.scanner.server.vulnerability.signatureAttack.publiclyKnownSecrets.name=Publicly Well Known HMac Secret Attack
8888
jwt.scanner.server.vulnerability.signatureAttack.publiclyKnownSecrets.desc=JWT tokens signed using HMac algorithm requires secret key and there are publicly well known secret keys which should not be used for signing the JWT token as it can cause various attacks like identity theft, user impersonation etc.
8989
jwt.scanner.server.vulnerability.signatureAttack.publiclyKnownSecrets.refs=https://lab.wallarm.com/340-weak-jwt-secrets-you-should-check-in-your-code
9090
jwt.scanner.server.vulnerability.signatureAttack.publiclyKnownSecrets.soln=Secret keys used for signing should not be publicly well known or easy to guess.
@@ -101,4 +101,4 @@ jwt.scanner.server.vulnerability.miscAttack.emptyTokens.soln=Tokens even if empt
101101

102102
# JWT scanner references and solutions
103103
jwt.scanner.refs=https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html
104-
jwt.scanner.soln=See reference for further information. The solution depends on implementation details
104+
jwt.scanner.soln=See reference for further information. The solution depends on implementation details

0 commit comments

Comments
 (0)