Skip to content

Commit faa483a

Browse files
am0o0am0o0
committed
move to CWE-347, update comments of tests
1 parent 9da815a commit faa483a

File tree

9 files changed

+134
-11
lines changed

9 files changed

+134
-11
lines changed

‎javascript/ql/src/Security/CWE-321-noVerification/Example.js renamed to ‎javascript/ql/src/Security/CWE-347-noVerification/Example.js

File renamed without changes.

‎javascript/ql/src/Security/CWE-321-noVerification/JsonWebToken.ql renamed to ‎javascript/ql/src/Security/CWE-347-noVerification/JsonWebToken.ql

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@
33
* @description The application does not verify the JWT payload with a cryptographic secret or public key.
44
* @kind path-problem
55
* @problem.severity error
6-
* @security-severity 9.0
6+
* @security-severity 8.0
77
* @precision high
8-
* @id js/jwt-missing-verification
8+
* @id js/jwt-missing-verification-jsonwebtoken
99
* @tags security
10-
* external/cwe/cwe-321
10+
* external/cwe/cwe-347
1111
*/
1212

1313
import javascript

‎javascript/ql/src/Security/CWE-321-noVerification/jose.ql renamed to ‎javascript/ql/src/Security/CWE-347-noVerification/jose.ql

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
* @name JWT missing secret or public key verification
33
* @description The application does not verify the JWT payload with a cryptographic secret or public key.
44
* @kind problem
5-
* @problem.severity warning
6-
* @security-severity 7.0
5+
* @problem.severity error
6+
* @security-severity 8.0
77
* @precision high
8-
* @id js/jwt-missing-verification
8+
* @id js/jwt-missing-verification-jose
99
* @tags security
1010
* external/cwe/cwe-347
1111
*/

‎javascript/ql/src/Security/CWE-321-noVerification/jwtDecode.ql renamed to ‎javascript/ql/src/Security/CWE-347-noVerification/jwtDecode.ql

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
* @name JWT missing secret or public key verification
33
* @description The application does not verify the JWT payload with a cryptographic secret or public key.
44
* @kind problem
5-
* @problem.severity warning
6-
* @security-severity 7.0
5+
* @problem.severity error
6+
* @security-severity 8.0
77
* @precision high
8-
* @id js/jwt-missing-verification
8+
* @id js/jwt-missing-verification-jwt-decode
99
* @tags security
1010
* external/cwe/cwe-347
1111
*/

‎javascript/ql/src/Security/CWE-321-noVerification/jwtNoVerification.qhelp renamed to ‎javascript/ql/src/Security/CWE-347-noVerification/jwtNoVerification.qhelp

File renamed without changes.

‎javascript/ql/src/Security/CWE-321-noVerification/jwtSimple.ql renamed to ‎javascript/ql/src/Security/CWE-347-noVerification/jwtSimple.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
* @name JWT missing secret or public key verification
33
* @description The application does not verify the JWT payload with a cryptographic secret or public key.
44
* @kind problem
5-
* @problem.severity warning
6-
* @security-severity 7.0
5+
* @problem.severity error
6+
* @security-severity 8.0
77
* @precision high
88
* @id js/jwt-missing-verification
99
* @tags security

‎javascript/ql/test/query-tests/Security/CWE-347-noVerification/NoVerification.js

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
const express = require('express')
2+
const app = express()
3+
const jwtJsonwebtoken = require('jsonwebtoken');
4+
const { getSecret } = require('./Config.js');
5+
const jwt_decode = require('jwt-decode');
6+
const jwt_simple = require('jwt-simple');
7+
const jose = require('jose')
8+
const port = 3000
9+
10+
async function startSymmetric(token) {
11+
const { payload, protectedHeader } = await jose.jwtVerify(token, new TextEncoder().encode(getSecret()))
12+
return {
13+
payload, protectedHeader
14+
}
15+
}
16+
17+
app.get('/jose', (req, res) => {
18+
const UserToken = req.headers.authorization;
19+
20+
// jose
21+
jose.decodeJwt(UserToken) // NOT OK: no signature verification
22+
23+
startSymmetric(UserToken).then(result => console.log(result)) // OK: with signature verification
24+
25+
26+
})
27+
28+
29+
app.get('/jwtDecode', (req, res) => {
30+
const UserToken = req.headers.authorization;
31+
32+
// jwt-decode
33+
jwt_decode(UserToken) // NOT OK: no signature verification
34+
})
35+
36+
app.get('/jwtSimple', (req, res) => {
37+
const UserToken = req.headers.authorization;
38+
39+
// jwt-simple
40+
// jwt.decode(token, key, noVerify, algorithm)
41+
jwt_simple.decode(UserToken, getSecret(), true); // NOT OK: no signature verification
42+
})
43+
44+
app.get('/jwtSimple2', (req, res) => {
45+
const UserToken = req.headers.authorization;
46+
47+
// jwt-simple
48+
// jwt.decode(token, key, noVerify, algorithm)
49+
jwt_simple.decode(UserToken, getSecret(), false); // OK: with signature verification
50+
jwt_simple.decode(UserToken, getSecret()); // OK: with signature verification
51+
})
52+
53+
app.get('/jwtSimple3', (req, res) => {
54+
const UserToken = req.headers.authorization;
55+
56+
// jwt-simple
57+
// jwt.decode(token, key, noVerify, algorithm)
58+
jwt_simple.decode(UserToken, getSecret(), true); // OK: verify the signature of same token in next line
59+
jwt_simple.decode(UserToken, getSecret()); // OK
60+
})
61+
62+
app.get('/jwtJsonwebtoken', (req, res) => {
63+
const UserToken = req.headers.authorization;
64+
65+
jwtJsonwebtoken.decode(UserToken) // NOT OK: no signature verification
66+
jwtJsonwebtoken.verify(UserToken, false, { algorithms: ["HS256", "none"] }) // NOT OK: no signature verification
67+
})
68+
69+
app.get('/jwtJsonwebtoken2', (req, res) => {
70+
const UserToken = req.headers.authorization;
71+
72+
jwtJsonwebtoken.verify(UserToken, getSecret()) // OK: with signature verification
73+
})
74+
75+
app.get('/jwtJsonwebtoken3', (req, res) => {
76+
const UserToken = req.headers.authorization;
77+
78+
jwtJsonwebtoken.decode(UserToken) // OK: verify the signature of same token in next line
79+
jwtJsonwebtoken.verify(UserToken, getSecret()) // OK
80+
})
81+
82+
app.listen(port, () => {
83+
console.log(`Example app listening on port ${port}`)
84+
})

‎javascript/ql/test/query-tests/Security/CWE-347-noVerification/jwtNoVerification.expected

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
nodes
2+
| NoVerification.js:63:11:63:47 | UserToken |
3+
| NoVerification.js:63:23:63:47 | req.hea ... ization |
4+
| NoVerification.js:63:23:63:47 | req.hea ... ization |
5+
| NoVerification.js:65:28:65:36 | UserToken |
6+
| NoVerification.js:65:28:65:36 | UserToken |
7+
| NoVerification.js:66:28:66:36 | UserToken |
8+
| NoVerification.js:66:28:66:36 | UserToken |
9+
| NoVerification.js:70:11:70:47 | UserToken |
10+
| NoVerification.js:70:23:70:47 | req.hea ... ization |
11+
| NoVerification.js:70:23:70:47 | req.hea ... ization |
12+
| NoVerification.js:72:28:72:36 | UserToken |
13+
| NoVerification.js:72:28:72:36 | UserToken |
14+
| NoVerification.js:76:11:76:47 | UserToken |
15+
| NoVerification.js:76:23:76:47 | req.hea ... ization |
16+
| NoVerification.js:76:23:76:47 | req.hea ... ization |
17+
| NoVerification.js:78:28:78:36 | UserToken |
18+
| NoVerification.js:78:28:78:36 | UserToken |
19+
| NoVerification.js:79:28:79:36 | UserToken |
20+
| NoVerification.js:79:28:79:36 | UserToken |
21+
edges
22+
| NoVerification.js:63:11:63:47 | UserToken | NoVerification.js:65:28:65:36 | UserToken |
23+
| NoVerification.js:63:11:63:47 | UserToken | NoVerification.js:65:28:65:36 | UserToken |
24+
| NoVerification.js:63:11:63:47 | UserToken | NoVerification.js:66:28:66:36 | UserToken |
25+
| NoVerification.js:63:11:63:47 | UserToken | NoVerification.js:66:28:66:36 | UserToken |
26+
| NoVerification.js:63:23:63:47 | req.hea ... ization | NoVerification.js:63:11:63:47 | UserToken |
27+
| NoVerification.js:63:23:63:47 | req.hea ... ization | NoVerification.js:63:11:63:47 | UserToken |
28+
| NoVerification.js:70:11:70:47 | UserToken | NoVerification.js:72:28:72:36 | UserToken |
29+
| NoVerification.js:70:11:70:47 | UserToken | NoVerification.js:72:28:72:36 | UserToken |
30+
| NoVerification.js:70:23:70:47 | req.hea ... ization | NoVerification.js:70:11:70:47 | UserToken |
31+
| NoVerification.js:70:23:70:47 | req.hea ... ization | NoVerification.js:70:11:70:47 | UserToken |
32+
| NoVerification.js:76:11:76:47 | UserToken | NoVerification.js:78:28:78:36 | UserToken |
33+
| NoVerification.js:76:11:76:47 | UserToken | NoVerification.js:78:28:78:36 | UserToken |
34+
| NoVerification.js:76:11:76:47 | UserToken | NoVerification.js:79:28:79:36 | UserToken |
35+
| NoVerification.js:76:11:76:47 | UserToken | NoVerification.js:79:28:79:36 | UserToken |
36+
| NoVerification.js:76:23:76:47 | req.hea ... ization | NoVerification.js:76:11:76:47 | UserToken |
37+
| NoVerification.js:76:23:76:47 | req.hea ... ization | NoVerification.js:76:11:76:47 | UserToken |
38+
#select

‎javascript/ql/test/query-tests/Security/CWE-347-noVerification/jwtNoVerification.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-347-noVerification/JsonWebToken.ql

0 commit comments

Comments
 (0)