5
5
* @problem.severity error
6
6
* @security-severity 7.8
7
7
* @precision high
8
- * @id java/missing-jwt-signature-check
8
+ * @id java/missing-jwt-signature-check-auth0
9
9
* @tags security
10
10
* external/cwe/cwe-347
11
11
*/
@@ -22,14 +22,14 @@ module JwtAuth0 {
22
22
JwtType ( ) { this .hasQualifiedName ( "com.auth0.jwt" , "JWT" ) }
23
23
}
24
24
25
- class JwtVerifierType extends RefType {
26
- JwtVerifierType ( ) { this .hasQualifiedName ( "com.auth0.jwt" , "JWTVerifier" ) }
25
+ class JwtVerifierType extends RefType {
26
+ JwtVerifierType ( ) { this .hasQualifiedName ( "com.auth0.jwt" , "JWTVerifier" ) }
27
27
}
28
28
29
29
/**
30
30
* A Method that returns a Decoded Claim of JWT
31
31
*/
32
- class GetPayload extends MethodAccess {
32
+ class GetPayload extends MethodCall {
33
33
GetPayload ( ) {
34
34
this .getCallee ( ) .getDeclaringType ( ) instanceof PayloadType and
35
35
this .getCallee ( ) .hasName ( [ "getClaim" , "getIssuedAt" ] )
@@ -39,7 +39,7 @@ module JwtAuth0 {
39
39
/**
40
40
* A Method that Decode JWT without signature verification
41
41
*/
42
- class Decode extends MethodAccess {
42
+ class Decode extends MethodCall {
43
43
Decode ( ) {
44
44
this .getCallee ( ) .getDeclaringType ( ) instanceof JwtType and
45
45
this .getCallee ( ) .hasName ( "decode" )
@@ -49,9 +49,9 @@ module JwtAuth0 {
49
49
/**
50
50
* A Method that Decode JWT with signature verification
51
51
*/
52
- class Verify extends MethodAccess {
52
+ class Verify extends MethodCall {
53
53
Verify ( ) {
54
- this .getCallee ( ) .getDeclaringType ( ) instanceof JwtVerifierType and
54
+ this .getCallee ( ) .getDeclaringType ( ) instanceof JwtVerifierType and
55
55
this .getCallee ( ) .hasName ( "verify" )
56
56
}
57
57
}
0 commit comments