Skip to content

Commit ebf004a

Browse files
authored
Update MissingJWTSignatureCheck.qhelp
Using same syntax as on other queries for 'BAD' and 'GOOD'.
1 parent 76905c4 commit ebf004a

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

java/ql/src/Security/CWE/CWE-347/MissingJWTSignatureCheck.qhelp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,9 @@ by overriding the <code>onPlaintextJws</code> or <code>onClaimsJws</code> of <co
2525
<example>
2626

2727
<p>The following example shows four cases where a signing key is set for a parser.
28-
In the first bad case the <code>parse</code> method is used which will not validate the signature.
29-
The second bad case uses a <code>JwtHandlerAdapter</code> where the <code>onPlaintextJwt</code> method is overriden so it will not validate the signature.
30-
The third and fourth good cases use <code>parseClaimsJws</code> method or override the <code>onPlaintextJws</code> method.
28+
In the first 'BAD' case the <code>parse</code> method is used, which will not validate the signature.
29+
The second 'BAD' case uses a <code>JwtHandlerAdapter</code> where the <code>onPlaintextJwt</code> method is overriden, so it will not validate the signature.
30+
The third and fourth 'GOOD' cases use <code>parseClaimsJws</code> method or override the <code>onPlaintextJws</code> method.
3131
</p>
3232

3333
<sample src="MissingJWTSignatureCheck.java" />

0 commit comments

Comments
 (0)