Skip to content

Commit 71e1d63

Browse files
am0o0am0o0
committed
finilize tests
1 parent 0d0dc51 commit 71e1d63

File tree

73 files changed

+1652
-136
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

73 files changed

+1652
-136
lines changed

‎java/ql/test/experimental/query-tests/security/CWE-347/Auth0NoVerifier.expected

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
edges
2+
| JwtNoVerifier.java:43:28:43:55 | getParameter(...) : String | JwtNoVerifier.java:44:39:44:47 | JwtToken2 : String |
3+
| JwtNoVerifier.java:44:39:44:47 | JwtToken2 : String | JwtNoVerifier.java:73:38:73:55 | token : String |
4+
| JwtNoVerifier.java:73:38:73:55 | token : String | JwtNoVerifier.java:74:37:74:41 | token : String |
5+
| JwtNoVerifier.java:74:26:74:42 | decode(...) : DecodedJWT | JwtNoVerifier.java:75:28:75:30 | jwt : DecodedJWT |
6+
| JwtNoVerifier.java:74:37:74:41 | token : String | JwtNoVerifier.java:74:26:74:42 | decode(...) : DecodedJWT |
7+
| JwtNoVerifier.java:75:16:75:31 | of(...) : Optional [<element>] : DecodedJWT | JwtNoVerifier.java:75:37:75:40 | item : DecodedJWT |
8+
| JwtNoVerifier.java:75:28:75:30 | jwt : DecodedJWT | JwtNoVerifier.java:75:16:75:31 | of(...) : Optional [<element>] : DecodedJWT |
9+
| JwtNoVerifier.java:75:37:75:40 | item : DecodedJWT | JwtNoVerifier.java:75:45:75:48 | item : DecodedJWT |
10+
| JwtNoVerifier.java:75:45:75:48 | item : DecodedJWT | JwtNoVerifier.java:75:45:75:69 | getClaim(...) |
11+
nodes
12+
| JwtNoVerifier.java:43:28:43:55 | getParameter(...) : String | semmle.label | getParameter(...) : String |
13+
| JwtNoVerifier.java:44:39:44:47 | JwtToken2 : String | semmle.label | JwtToken2 : String |
14+
| JwtNoVerifier.java:73:38:73:55 | token : String | semmle.label | token : String |
15+
| JwtNoVerifier.java:74:26:74:42 | decode(...) : DecodedJWT | semmle.label | decode(...) : DecodedJWT |
16+
| JwtNoVerifier.java:74:37:74:41 | token : String | semmle.label | token : String |
17+
| JwtNoVerifier.java:75:16:75:31 | of(...) : Optional [<element>] : DecodedJWT | semmle.label | of(...) : Optional [<element>] : DecodedJWT |
18+
| JwtNoVerifier.java:75:28:75:30 | jwt : DecodedJWT | semmle.label | jwt : DecodedJWT |
19+
| JwtNoVerifier.java:75:37:75:40 | item : DecodedJWT | semmle.label | item : DecodedJWT |
20+
| JwtNoVerifier.java:75:45:75:48 | item : DecodedJWT | semmle.label | item : DecodedJWT |
21+
| JwtNoVerifier.java:75:45:75:69 | getClaim(...) | semmle.label | getClaim(...) |
22+
subpaths
23+
#select
24+
| JwtNoVerifier.java:75:45:75:69 | getClaim(...) | JwtNoVerifier.java:43:28:43:55 | getParameter(...) : String | JwtNoVerifier.java:75:45:75:69 | getClaim(...) | This parses a $@, but the signature is not verified. | JwtNoVerifier.java:43:28:43:55 | getParameter(...) | JWT |

‎java/ql/test/experimental/query-tests/security/CWE-347/JwtNoVerifier.java

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
import java.io.*;
2+
import java.security.NoSuchAlgorithmException;
3+
import java.util.Objects;
4+
import java.util.Optional;
5+
import javax.crypto.KeyGenerator;
6+
import javax.servlet.http.*;
7+
import javax.servlet.annotation.*;
8+
9+
import com.auth0.jwt.JWT;
10+
import com.auth0.jwt.JWTVerifier;
11+
import com.auth0.jwt.algorithms.Algorithm;
12+
import com.auth0.jwt.exceptions.JWTVerificationException;
13+
import com.auth0.jwt.interfaces.DecodedJWT;
14+
15+
@WebServlet(description = "", displayName = "", largeIcon = "", name = "JwtTest1", smallIcon = "", urlPatterns = {}, value = "/Auth", initParams = {}, asyncSupported = false, loadOnStartup = 0)
16+
public class JwtNoVerifier extends HttpServlet {
17+
18+
public void doPost(HttpServletRequest request, HttpServletResponse response) {
19+
response.setContentType("text/html");
20+
PrintWriter out = response.getWriter();
21+
22+
// OK: first decode without signature verification
23+
// and then verify with signature verification
24+
String JwtToken1 = request.getParameter("JWT1");
25+
String userName = decodeToken(JwtToken1);
26+
verifyToken(JwtToken1, "A Securely generated Key");
27+
if (Objects.equals(userName, "Admin")) {
28+
out.println("<html><body>");
29+
out.println("<h1>" + "heyyy Admin" + "</h1>");
30+
out.println("</body></html>");
31+
}
32+
33+
out.println("<html><body>");
34+
out.println("<h1>" + "heyyy Nobody" + "</h1>");
35+
out.println("</body></html>");
36+
}
37+
38+
public void doGet(HttpServletRequest request, HttpServletResponse response) {
39+
response.setContentType("text/html");
40+
PrintWriter out = response.getWriter();
41+
42+
// NOT OK: only decode, no verification
43+
String JwtToken2 = request.getParameter("JWT2");
44+
String userName = decodeToken(JwtToken2);
45+
if (Objects.equals(userName, "Admin")) {
46+
out.println("<html><body>");
47+
out.println("<h1>" + "heyyy Admin" + "</h1>");
48+
out.println("</body></html>");
49+
}
50+
51+
// OK: no clue of the use of unsafe decoded JWT return value
52+
JwtToken2 = request.getParameter("JWT2");
53+
JWT.decode(JwtToken2);
54+
55+
56+
out.println("<html><body>");
57+
out.println("<h1>" + "heyyy Nobody" + "</h1>");
58+
out.println("</body></html>");
59+
}
60+
61+
public static boolean verifyToken(final String token, final String key) {
62+
try {
63+
JWTVerifier verifier = JWT.require(Algorithm.HMAC256(key)).build();
64+
verifier.verify(token);
65+
return true;
66+
} catch (JWTVerificationException e) {
67+
System.out.printf("jwt decode fail, token: %s", e);
68+
}
69+
return false;
70+
}
71+
72+
73+
public static String decodeToken(final String token) {
74+
DecodedJWT jwt = JWT.decode(token);
75+
return Optional.of(jwt).map(item -> item.getClaim("userName").asString()).orElse("");
76+
}
77+
78+
79+
private static String getSecureRandomKey() throws NoSuchAlgorithmException {
80+
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
81+
keyGen.init(256); // for example
82+
return keyGen.generateKey().toString();
83+
}
84+
85+
static final String JWT_KEY = "KEY";
86+
87+
public static void NoNeedForTest(HttpServletRequest request) {
88+
// constant key
89+
String JwtToken3 = request.getParameter("JWT3");
90+
verifyToken(JwtToken3, JWT_KEY);
91+
92+
// none algorithm
93+
String JwtToken4 = request.getParameter("JWT4");
94+
try {
95+
verifyTokenNoneAlg(JwtToken4, getSecureRandomKey());
96+
} catch (NoSuchAlgorithmException e) {
97+
throw new RuntimeException(e);
98+
}
99+
100+
}
101+
102+
public static String generateToken(final String userName, final String key) {
103+
try {
104+
return JWT.create().withClaim("userName", userName).sign(Algorithm.HMAC256(key));
105+
} catch (IllegalArgumentException e) {
106+
System.out.printf("JWTToken generate fail %s", e);
107+
}
108+
return "";
109+
}
110+
111+
public static boolean verifyTokenNoneAlg(final String token, final String key) {
112+
try {
113+
JWTVerifier verifier = JWT.require(Algorithm.none()).build();
114+
verifier.verify(token);
115+
return true;
116+
} catch (JWTVerificationException e) {
117+
System.out.printf("jwt decode fail, token: %s", e);
118+
}
119+
return false;
120+
}
121+
}

‎java/ql/test/experimental/query-tests/security/CWE-347/Test.java

Lines changed: 0 additions & 92 deletions
This file was deleted.

‎java/ql/test/experimental/query-tests/security/CWE-347/options

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/auth0-jwt-4.4.0/:${testdir}/../../../../stubs/javax-servlet-2.5/
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/auth0-java-jwt-4.4.0:${testdir}/../../../stubs/javax.servlet-api-4.0.1

‎java/ql/test/experimental/query-tests/security/CWE-347/pom.xml

Lines changed: 0 additions & 43 deletions
This file was deleted.

‎java/ql/test/experimental/stubs/auth0-java-jwt-4.4.0/com/auth0/jwt/JWT.java

Lines changed: 17 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/experimental/stubs/auth0-java-jwt-4.4.0/com/auth0/jwt/JWTCreator.java

Lines changed: 46 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/experimental/stubs/auth0-java-jwt-4.4.0/com/auth0/jwt/JWTVerifier.java

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)