@@ -42,26 +42,26 @@ private class JwtParserParseHandlerMethod extends Method {
42
42
}
43
43
44
44
/** The `parse(token)`, `parseClaimsJwt(token)` and `parsePlaintextJwt(token)` methods defined in `JwtParser`. */
45
- private class JwtParserInsecureParseMethods extends Method {
46
- JwtParserInsecureParseMethods ( ) {
45
+ private class JwtParserInsecureParseMethod extends Method {
46
+ JwtParserInsecureParseMethod ( ) {
47
47
this .hasName ( [ "parse" , "parseClaimsJwt" , "parsePlaintextJwt" ] ) and
48
48
this .getNumberOfParameters ( ) = 1 and
49
49
this .getDeclaringType ( ) instanceof TypeJwtParser
50
50
}
51
51
}
52
52
53
53
/** The `on(Claims|Plaintext)Jwt` methods defined in `JwtHandler`. */
54
- private class JwtHandlerOnJwtMethods extends Method {
55
- JwtHandlerOnJwtMethods ( ) {
54
+ private class JwtHandlerOnJwtMethod extends Method {
55
+ JwtHandlerOnJwtMethod ( ) {
56
56
this .hasName ( [ "onClaimsJwt" , "onPlaintextJwt" ] ) and
57
57
this .getNumberOfParameters ( ) = 1 and
58
58
this .getDeclaringType ( ) instanceof TypeJwtHandler
59
59
}
60
60
}
61
61
62
62
/** The `on(Claims|Plaintext)Jwt` methods defined in `JwtHandlerAdapter`. */
63
- private class JwtHandlerAdapterOnJwtMethods extends Method {
64
- JwtHandlerAdapterOnJwtMethods ( ) {
63
+ private class JwtHandlerAdapterOnJwtMethod extends Method {
64
+ JwtHandlerAdapterOnJwtMethod ( ) {
65
65
this .hasName ( [ "onClaimsJwt" , "onPlaintextJwt" ] ) and
66
66
this .getNumberOfParameters ( ) = 1 and
67
67
this .getDeclaringType ( ) instanceof TypeJwtHandlerAdapter
@@ -70,17 +70,17 @@ private class JwtHandlerAdapterOnJwtMethods extends Method {
70
70
71
71
/**
72
72
* Holds if `parseHandlerExpr` is an insecure `JwtHandler`.
73
- * That is, it overrides a method from `JwtHandlerOnJwtMethods ` and the overridden method is not a method from `JwtHandlerAdapterOnJwtMethods `.
74
- * A overridden method which is a method from `JwtHandlerAdapterOnJwtMethods ` is safe, because these always throw an exception.
73
+ * That is, it overrides a method from `JwtHandlerOnJwtMethod ` and the overridden method is not a method from `JwtHandlerAdapterOnJwtMethod `.
74
+ * A overridden method which is a method from `JwtHandlerAdapterOnJwtMethod ` is safe, because these always throw an exception.
75
75
*/
76
76
private predicate isInsecureParseHandler ( Expr parseHandlerExpr ) {
77
77
exists ( RefType t |
78
78
parseHandlerExpr .getType ( ) = t and
79
79
t .getASourceSupertype * ( ) instanceof TypeJwtHandler and
80
80
exists ( Method m |
81
81
m = t .getAMethod ( ) and
82
- m .getASourceOverriddenMethod + ( ) instanceof JwtHandlerOnJwtMethods and
83
- not m .getSourceDeclaration ( ) instanceof JwtHandlerAdapterOnJwtMethods
82
+ m .getASourceOverriddenMethod + ( ) instanceof JwtHandlerOnJwtMethod and
83
+ not m .getSourceDeclaration ( ) instanceof JwtHandlerAdapterOnJwtMethod
84
84
)
85
85
)
86
86
}
@@ -92,7 +92,7 @@ private predicate isInsecureParseHandler(Expr parseHandlerExpr) {
92
92
*/
93
93
private class JwtParserInsecureParseMethodAccess extends MethodAccess {
94
94
JwtParserInsecureParseMethodAccess ( ) {
95
- this .getMethod ( ) .getASourceOverriddenMethod * ( ) instanceof JwtParserInsecureParseMethods
95
+ this .getMethod ( ) .getASourceOverriddenMethod * ( ) instanceof JwtParserInsecureParseMethod
96
96
or
97
97
this .getMethod ( ) .getASourceOverriddenMethod * ( ) instanceof JwtParserParseHandlerMethod and
98
98
isInsecureParseHandler ( this .getArgument ( 1 ) )
0 commit comments