Skip to content

Commit 0d0dc51

Browse files
am0o0am0o0
committed
stash
1 parent 97eb7b7 commit 0d0dc51

File tree

103 files changed

+5661
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

103 files changed

+5661
-0
lines changed

‎java/ql/test/experimental/query-tests/security/CWE-347/Auth0NoVerifier.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE/CWE-347/Auth0NoVerifier.ql

‎java/ql/test/experimental/query-tests/security/CWE-347/Test.java

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
package com.example.JwtTest;
2+
3+
import java.io.*;
4+
import java.security.NoSuchAlgorithmException;
5+
import java.util.Objects;
6+
import java.util.Optional;
7+
import com.auth0.jwt.JWT;
8+
import com.auth0.jwt.JWTVerifier;
9+
import com.auth0.jwt.algorithms.Algorithm;
10+
import com.auth0.jwt.exceptions.JWTCreationException;
11+
import com.auth0.jwt.exceptions.JWTVerificationException;
12+
import com.auth0.jwt.interfaces.DecodedJWT;
13+
import javax.servlet.ServletException;
14+
import javax.servlet.http.HttpServlet;
15+
import javax.servlet.http.HttpServletRequest;
16+
import javax.servlet.http.HttpServletResponse;
17+
18+
public class Test extends HttpServlet {
19+
20+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
21+
throws ServletException, IOException {
22+
try {
23+
response.setContentType("text/html");
24+
PrintWriter out = response.getWriter();
25+
26+
// OK: first decode without signature verification
27+
// and then verify with signature verification
28+
String JwtToken1 = request.getParameter("JWT1");
29+
String userName = decodeToken(JwtToken1);
30+
verifyToken(JwtToken1, "A Securely generated Key");
31+
if (Objects.equals(userName, "Admin")) {
32+
out.println("<html><body>");
33+
out.println("<h1>" + "heyyy Admin" + "</h1>");
34+
out.println("</body></html>");
35+
}
36+
37+
out.println("<html><body>");
38+
out.println("<h1>" + "heyyy Nobody" + "</h1>");
39+
out.println("</body></html>");
40+
} catch (Exception e) {
41+
// TODO: handle exception
42+
}
43+
}
44+
45+
public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
46+
response.setContentType("text/html");
47+
PrintWriter out = response.getWriter();
48+
49+
// NOT OK: only decode, no verification
50+
String JwtToken2 = request.getParameter("JWT2");
51+
String userName = decodeToken(JwtToken2);
52+
if (Objects.equals(userName, "Admin")) {
53+
out.println("<html><body>");
54+
out.println("<h1>" + "heyyy Admin" + "</h1>");
55+
out.println("</body></html>");
56+
}
57+
58+
// OK: no clue of the use of unsafe decoded JWT return value
59+
JwtToken2 = request.getParameter("JWT2");
60+
JWT.decode(JwtToken2);
61+
62+
63+
out.println("<html><body>");
64+
out.println("<h1>" + "heyyy Nobody" + "</h1>");
65+
out.println("</body></html>");
66+
}
67+
68+
public static boolean verifyToken(final String token, final String key) {
69+
try {
70+
JWTVerifier verifier = JWT.require(Algorithm.HMAC256(key)).build();
71+
verifier.verify(token);
72+
return true;
73+
} catch (JWTVerificationException e) {
74+
System.out.printf("jwt decode fail, token: %s", e);
75+
}
76+
return false;
77+
}
78+
79+
80+
public static String decodeToken(final String token) {
81+
DecodedJWT jwt = JWT.decode(token);
82+
return Optional.of(jwt).map(item -> item.getClaim("userName").asString()).orElse("");
83+
}
84+
85+
86+
private static String getSecureRandomKey() throws NoSuchAlgorithmException {
87+
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
88+
keyGen.init(256); // for example
89+
return keyGen.generateKey().toString();
90+
}
91+
static final String JWT_KEY = "KEY";
92+
}

‎java/ql/test/experimental/query-tests/security/CWE-347/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/auth0-jwt-4.4.0/:${testdir}/../../../../stubs/javax-servlet-2.5/

‎java/ql/test/experimental/query-tests/security/CWE-347/pom.xml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>com.example</groupId>
8+
<artifactId>JwtTest</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
<name>JwtTest</name>
11+
<packaging>war</packaging>
12+
13+
<properties>
14+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
15+
<maven.compiler.target>11</maven.compiler.target>
16+
<maven.compiler.source>11</maven.compiler.source>
17+
<junit.version>5.9.2</junit.version>
18+
</properties>
19+
20+
<dependencies>
21+
<dependency>
22+
<groupId>com.auth0</groupId>
23+
<artifactId>java-jwt</artifactId>
24+
<version>4.4.0</version>
25+
</dependency>
26+
<dependency>
27+
<groupId>javax.servlet</groupId>
28+
<artifactId>javax.servlet-api</artifactId>
29+
<version>4.0.1</version>
30+
<scope>provided</scope>
31+
</dependency>
32+
</dependencies>
33+
34+
<build>
35+
<plugins>
36+
<plugin>
37+
<groupId>org.apache.maven.plugins</groupId>
38+
<artifactId>maven-war-plugin</artifactId>
39+
<version>3.3.2</version>
40+
</plugin>
41+
</plugins>
42+
</build>
43+
</project>

‎java/ql/test/stubs/auth0-jwt-4.4.0/com/auth0/jwt/HeaderParams.java

Lines changed: 29 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/auth0-jwt-4.4.0/com/auth0/jwt/JWT.java

Lines changed: 74 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)