Skip to content

Commit 885044e

Browse files
intrigusintrigus
committed
[Java] Add tests for jwt signature check query.
1 parent b7e49c7 commit 885044e

File tree

3 files changed

+173
-0
lines changed

3 files changed

+173
-0
lines changed

‎java/ql/test/experimental/query-tests/security/CWE-347/MissingJWTSignatureCheck.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
| MissingJWTSignatureCheck.java:96:9:96:27 | parse(...) | A signing key is set $@, but the signature is not verified. | MissingJWTSignatureCheck.java:18:16:18:66 | setSigningKey(...) | here |
2+
| MissingJWTSignatureCheck.java:96:9:96:27 | parse(...) | A signing key is set $@, but the signature is not verified. | MissingJWTSignatureCheck.java:22:16:22:73 | setSigningKey(...) | here |
3+
| MissingJWTSignatureCheck.java:96:9:96:27 | parse(...) | A signing key is set $@, but the signature is not verified. | MissingJWTSignatureCheck.java:26:16:26:75 | setSigningKey(...) | here |
4+
| MissingJWTSignatureCheck.java:100:9:105:22 | parse(...) | A signing key is set $@, but the signature is not verified. | MissingJWTSignatureCheck.java:18:16:18:66 | setSigningKey(...) | here |
5+
| MissingJWTSignatureCheck.java:100:9:105:22 | parse(...) | A signing key is set $@, but the signature is not verified. | MissingJWTSignatureCheck.java:22:16:22:73 | setSigningKey(...) | here |
6+
| MissingJWTSignatureCheck.java:100:9:105:22 | parse(...) | A signing key is set $@, but the signature is not verified. | MissingJWTSignatureCheck.java:26:16:26:75 | setSigningKey(...) | here |
7+
| MissingJWTSignatureCheck.java:127:9:129:33 | parse(...) | A signing key is set $@, but the signature is not verified. | MissingJWTSignatureCheck.java:127:9:128:58 | setSigningKey(...) | here |
8+
| MissingJWTSignatureCheck.java:133:9:140:22 | parse(...) | A signing key is set $@, but the signature is not verified. | MissingJWTSignatureCheck.java:133:9:134:58 | setSigningKey(...) | here |

‎java/ql/test/experimental/query-tests/security/CWE-347/MissingJWTSignatureCheck.java

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jwtk-jjwt-0.11.2
2+
3+
import io.jsonwebtoken.Jwts;
4+
import io.jsonwebtoken.JwtParser;
5+
import io.jsonwebtoken.Jwt;
6+
import io.jsonwebtoken.Jws;
7+
import io.jsonwebtoken.Header;
8+
import io.jsonwebtoken.JwtParserBuilder;
9+
import io.jsonwebtoken.JwtHandlerAdapter;
10+
import io.jsonwebtoken.impl.DefaultJwtParser;
11+
12+
public class MissingJWTSignatureCheck {
13+
14+
15+
// SIGNED
16+
17+
private JwtParser getASignedParser() {
18+
return Jwts.parser().setSigningKey("someBase64EncodedKey");
19+
}
20+
21+
private JwtParser getASignedParserFromParserBuilder() {
22+
return Jwts.parserBuilder().setSigningKey("someBase64EncodedKey").build();
23+
}
24+
25+
private JwtParser getASignedNewParser() {
26+
return new DefaultJwtParser().setSigningKey("someBase64EncodedKey");
27+
}
28+
29+
private void callSignedParsers() {
30+
JwtParser parser1 = getASignedParser();
31+
badJwtOnParserBuilder(parser1, "");
32+
badJwtHandlerOnParserBuilder(parser1, "");
33+
goodJwtOnParserBuilder(parser1, "");
34+
goodJwtHandler(parser1, "");
35+
36+
JwtParser parser2 = getASignedParserFromParserBuilder();
37+
badJwtOnParserBuilder(parser2, "");
38+
badJwtHandlerOnParserBuilder(parser2, "");
39+
goodJwtOnParserBuilder(parser2, "");
40+
goodJwtHandler(parser2, "");
41+
42+
JwtParser parser3 = getASignedNewParser();
43+
badJwtOnParserBuilder(parser3, "");
44+
badJwtHandlerOnParserBuilder(parser3, "");
45+
goodJwtOnParserBuilder(parser3, "");
46+
goodJwtHandler(parser3, "");
47+
}
48+
49+
// SIGNED END
50+
51+
// UNSIGNED
52+
53+
private JwtParser getAnUnsignedParser() {
54+
return Jwts.parser();
55+
}
56+
57+
private JwtParser getAnUnsignedParserFromParserBuilder() {
58+
return Jwts.parserBuilder().build();
59+
}
60+
61+
private JwtParser getAnUnsignedNewParser() {
62+
return new DefaultJwtParser();
63+
}
64+
65+
private void callUnsignedParsers() {
66+
JwtParser parser1 = getAnUnsignedParser();
67+
badJwtOnParserBuilder(parser1, "");
68+
badJwtHandlerOnParserBuilder(parser1, "");
69+
goodJwtOnParserBuilder(parser1, "");
70+
goodJwtHandler(parser1, "");
71+
72+
JwtParser parser2 = getAnUnsignedParserFromParserBuilder();
73+
badJwtOnParserBuilder(parser2, "");
74+
badJwtHandlerOnParserBuilder(parser2, "");
75+
goodJwtOnParserBuilder(parser2, "");
76+
goodJwtHandler(parser2, "");
77+
78+
JwtParser parser3 = getAnUnsignedNewParser();
79+
badJwtOnParserBuilder(parser3, "");
80+
badJwtHandlerOnParserBuilder(parser3, "");
81+
goodJwtOnParserBuilder(parser3, "");
82+
goodJwtHandler(parser3, "");
83+
}
84+
85+
private void signParserAfterParseCall() {
86+
JwtParser parser = getAnUnsignedParser();
87+
parser.parse(""); // Should not be detected
88+
parser.setSigningKey("someBase64EncodedKey");
89+
}
90+
91+
// UNSIGNED END
92+
93+
// INDIRECT
94+
95+
private void badJwtOnParserBuilder(JwtParser parser, String token) {
96+
parser.parse(token); // BAD: Does not verify the signature
97+
}
98+
99+
private void badJwtHandlerOnParserBuilder(JwtParser parser, String token) {
100+
parser.parse(token, new JwtHandlerAdapter<Jwt<Header, String>>() { // BAD: The handler is called on an unverified JWT
101+
@Override
102+
public Jwt<Header, String> onPlaintextJwt(Jwt<Header, String> jwt) {
103+
return jwt;
104+
}
105+
});
106+
}
107+
108+
private void goodJwtOnParserBuilder(JwtParser parser, String token) {
109+
parser.parseClaimsJws(token) // GOOD: Verify the signature
110+
.getBody();
111+
}
112+
113+
private void goodJwtHandler(JwtParser parser, String token) {
114+
parser.parse(token, new JwtHandlerAdapter<Jws<String>>() { // GOOD: The handler is called on a verified JWS
115+
@Override
116+
public Jws<String> onPlaintextJws(Jws<String> jws) {
117+
return jws;
118+
}
119+
});
120+
}
121+
122+
// INDIRECT END
123+
124+
// DIRECT
125+
126+
private void badJwtOnParserBuilder(String token) {
127+
Jwts.parserBuilder()
128+
.setSigningKey("someBase64EncodedKey").build()
129+
.parse(token); // BAD: Does not verify the signature
130+
}
131+
132+
private void badJwtHandlerOnParser(String token) {
133+
Jwts.parser()
134+
.setSigningKey("someBase64EncodedKey")
135+
.parse(token, new JwtHandlerAdapter<Jwt<Header, String>>() { // BAD: The handler is called on an unverified JWT
136+
@Override
137+
public Jwt<Header, String> onPlaintextJwt(Jwt<Header, String> jwt) {
138+
return jwt;
139+
}
140+
});
141+
}
142+
143+
private void goodJwtOnParser(String token) {
144+
Jwts.parser()
145+
.setSigningKey("someBase64EncodedKey")
146+
.parseClaimsJws(token) // GOOD: Verify the signature
147+
.getBody();
148+
}
149+
150+
private void goodJwtHandlerOnParserBuilder(String token) {
151+
Jwts.parserBuilder()
152+
.setSigningKey("someBase64EncodedKey").build()
153+
.parse(token, new JwtHandlerAdapter<Jws<String>>() { // GOOD: The handler is called on a verified JWS
154+
@Override
155+
public Jws<String> onPlaintextJws(Jws<String> jws) {
156+
return jws;
157+
}
158+
});
159+
}
160+
161+
// DIRECT END
162+
163+
164+
}

‎java/ql/test/experimental/query-tests/security/CWE-347/MissingJWTSignatureCheck.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql

0 commit comments

Comments
 (0)