Skip to content

Commit 14daf58

Browse files
am0o0am0o0
committed
update tests, add test cases for query with local sources
1 parent 8fde8c2 commit 14daf58

18 files changed

+276
-212
lines changed

‎javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerificationLocalSource.ql

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,7 @@ class Configuration extends TaintTracking::Configuration {
1818
Configuration() { this = "jsonwebtoken without any signature verification" }
1919

2020
override predicate isSource(DataFlow::Node source) {
21-
source =
22-
API::moduleImport("jsonwebtoken")
23-
.getMember("decode")
24-
.getParameter(0)
25-
.asSink()
26-
.getALocalSource()
21+
source = [unverifiedDecode(), verifiedDecode()].getALocalSource()
2722
}
2823

2924
override predicate isSink(DataFlow::Node sink) {

‎javascript/ql/test/experimental/Security/CWE-347/JsonWebToken.js

Lines changed: 51 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,40 +13,83 @@ app.get('/jwtJsonwebtoken1', (req, res) => {
1313
const UserToken = req.headers.authorization;
1414

1515
// BAD: no signature verification
16-
jwtJsonwebtoken.decode(UserToken)
16+
jwtJsonwebtoken.decode(UserToken) // NOT OK
1717
})
1818

1919
app.get('/jwtJsonwebtoken2', (req, res) => {
2020
const UserToken = req.headers.authorization;
2121

2222
// BAD: no signature verification
23-
jwtJsonwebtoken.decode(UserToken)
24-
jwtJsonwebtoken.verify(UserToken, getSecret(), { algorithms: ["HS256", "none"] })
23+
jwtJsonwebtoken.decode(UserToken) // NOT OK
24+
jwtJsonwebtoken.verify(UserToken, getSecret(), { algorithms: ["HS256", "none"] }) // NOT OK
2525
})
2626

2727
app.get('/jwtJsonwebtoken3', (req, res) => {
2828
const UserToken = req.headers.authorization;
2929

3030
// GOOD: with signature verification
31-
jwtJsonwebtoken.verify(UserToken, getSecret())
31+
jwtJsonwebtoken.verify(UserToken, getSecret()) // OK
3232
})
3333

3434
app.get('/jwtJsonwebtoken4', (req, res) => {
3535
const UserToken = req.headers.authorization;
3636

3737
// GOOD: first without signature verification then with signature verification for same UserToken
38-
jwtJsonwebtoken.decode(UserToken)
39-
jwtJsonwebtoken.verify(UserToken, getSecret())
38+
jwtJsonwebtoken.decode(UserToken) // OK
39+
jwtJsonwebtoken.verify(UserToken, getSecret()) // OK
4040
})
4141

4242
app.get('/jwtJsonwebtoken5', (req, res) => {
4343
const UserToken = req.headers.authorization;
4444

4545
// GOOD: first without signature verification then with signature verification for same UserToken
46-
jwtJsonwebtoken.decode(UserToken)
47-
jwtJsonwebtoken.verify(UserToken, getSecret(), { algorithms: ["HS256"] })
46+
jwtJsonwebtoken.decode(UserToken) // OK
47+
jwtJsonwebtoken.verify(UserToken, getSecret(), { algorithms: ["HS256"] }) // OK
4848
})
4949

5050
app.listen(port, () => {
5151
console.log(`Example app listening on port ${port}`)
5252
})
53+
54+
55+
function aJWT() {
56+
return "A JWT provided by user"
57+
}
58+
59+
(function () {
60+
const UserToken = aJwt()
61+
62+
// BAD: no signature verification
63+
jwtJsonwebtoken.decode(UserToken) // NOT OK
64+
})();
65+
66+
(function () {
67+
const UserToken = aJwt()
68+
69+
// BAD: no signature verification
70+
jwtJsonwebtoken.decode(UserToken) // NOT OK
71+
jwtJsonwebtoken.verify(UserToken, getSecret(), { algorithms: ["HS256", "none"] }) // NOT OK
72+
})();
73+
74+
(function () {
75+
const UserToken = aJwt()
76+
77+
// GOOD: with signature verification
78+
jwtJsonwebtoken.verify(UserToken, getSecret()) // OK
79+
})();
80+
81+
(function () {
82+
const UserToken = aJwt()
83+
84+
// GOOD: first without signature verification then with signature verification for same UserToken
85+
jwtJsonwebtoken.decode(UserToken) // OK
86+
jwtJsonwebtoken.verify(UserToken, getSecret()) // OK
87+
})();
88+
89+
(function () {
90+
const UserToken = aJwt()
91+
92+
// GOOD: first without signature verification then with signature verification for same UserToken
93+
jwtJsonwebtoken.decode(UserToken) // OK
94+
jwtJsonwebtoken.verify(UserToken, getSecret(), { algorithms: ["HS256"] }) // OK
95+
})();

‎javascript/ql/test/experimental/Security/CWE-347/JsonWebToken.qlref

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎javascript/ql/test/experimental/Security/CWE-347/JsonWebTokenNotWorking.expected

Lines changed: 0 additions & 75 deletions
This file was deleted.

‎javascript/ql/test/experimental/Security/CWE-347/JsonWebTokenNotWorking.qlref

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎javascript/ql/test/experimental/Security/CWE-347/decodeJwtWithoutVerification.expected

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
nodes
2+
| JsonWebToken.js:13:11:13:47 | UserToken |
3+
| JsonWebToken.js:13:23:13:47 | req.hea ... ization |
4+
| JsonWebToken.js:13:23:13:47 | req.hea ... ization |
5+
| JsonWebToken.js:16:28:16:36 | UserToken |
6+
| JsonWebToken.js:16:28:16:36 | UserToken |
7+
| JsonWebToken.js:20:11:20:47 | UserToken |
8+
| JsonWebToken.js:20:23:20:47 | req.hea ... ization |
9+
| JsonWebToken.js:20:23:20:47 | req.hea ... ization |
10+
| JsonWebToken.js:23:28:23:36 | UserToken |
11+
| JsonWebToken.js:23:28:23:36 | UserToken |
12+
| JsonWebToken.js:24:28:24:36 | UserToken |
13+
| JsonWebToken.js:24:28:24:36 | UserToken |
14+
| JsonWebToken.js:28:11:28:47 | UserToken |
15+
| JsonWebToken.js:28:23:28:47 | req.hea ... ization |
16+
| JsonWebToken.js:28:23:28:47 | req.hea ... ization |
17+
| JsonWebToken.js:31:28:31:36 | UserToken |
18+
| JsonWebToken.js:31:28:31:36 | UserToken |
19+
| JsonWebToken.js:35:11:35:47 | UserToken |
20+
| JsonWebToken.js:35:23:35:47 | req.hea ... ization |
21+
| JsonWebToken.js:35:23:35:47 | req.hea ... ization |
22+
| JsonWebToken.js:38:28:38:36 | UserToken |
23+
| JsonWebToken.js:38:28:38:36 | UserToken |
24+
| JsonWebToken.js:39:28:39:36 | UserToken |
25+
| JsonWebToken.js:39:28:39:36 | UserToken |
26+
| JsonWebToken.js:43:11:43:47 | UserToken |
27+
| JsonWebToken.js:43:23:43:47 | req.hea ... ization |
28+
| JsonWebToken.js:43:23:43:47 | req.hea ... ization |
29+
| JsonWebToken.js:46:28:46:36 | UserToken |
30+
| JsonWebToken.js:46:28:46:36 | UserToken |
31+
| JsonWebToken.js:47:28:47:36 | UserToken |
32+
| JsonWebToken.js:47:28:47:36 | UserToken |
33+
| jose.js:14:11:14:47 | UserToken |
34+
| jose.js:14:23:14:47 | req.hea ... ization |
35+
| jose.js:14:23:14:47 | req.hea ... ization |
36+
| jose.js:16:20:16:28 | UserToken |
37+
| jose.js:16:20:16:28 | UserToken |
38+
| jose.js:21:11:21:47 | UserToken |
39+
| jose.js:21:23:21:47 | req.hea ... ization |
40+
| jose.js:21:23:21:47 | req.hea ... ization |
41+
| jose.js:23:26:23:34 | UserToken |
42+
| jose.js:23:26:23:34 | UserToken |
43+
| jose.js:27:11:27:47 | UserToken |
44+
| jose.js:27:23:27:47 | req.hea ... ization |
45+
| jose.js:27:23:27:47 | req.hea ... ization |
46+
| jose.js:29:20:29:28 | UserToken |
47+
| jose.js:29:20:29:28 | UserToken |
48+
| jose.js:30:26:30:34 | UserToken |
49+
| jose.js:30:26:30:34 | UserToken |
50+
| jwtDecode.js:14:11:14:47 | UserToken |
51+
| jwtDecode.js:14:23:14:47 | req.hea ... ization |
52+
| jwtDecode.js:14:23:14:47 | req.hea ... ization |
53+
| jwtDecode.js:18:16:18:24 | UserToken |
54+
| jwtDecode.js:18:16:18:24 | UserToken |
55+
| jwtSimple.js:13:11:13:47 | UserToken |
56+
| jwtSimple.js:13:23:13:47 | req.hea ... ization |
57+
| jwtSimple.js:13:23:13:47 | req.hea ... ization |
58+
| jwtSimple.js:18:23:18:31 | UserToken |
59+
| jwtSimple.js:18:23:18:31 | UserToken |
60+
| jwtSimple.js:22:11:22:47 | UserToken |
61+
| jwtSimple.js:22:23:22:47 | req.hea ... ization |
62+
| jwtSimple.js:22:23:22:47 | req.hea ... ization |
63+
| jwtSimple.js:27:23:27:31 | UserToken |
64+
| jwtSimple.js:27:23:27:31 | UserToken |
65+
| jwtSimple.js:28:23:28:31 | UserToken |
66+
| jwtSimple.js:28:23:28:31 | UserToken |
67+
| jwtSimple.js:32:11:32:47 | UserToken |
68+
| jwtSimple.js:32:23:32:47 | req.hea ... ization |
69+
| jwtSimple.js:32:23:32:47 | req.hea ... ization |
70+
| jwtSimple.js:37:23:37:31 | UserToken |
71+
| jwtSimple.js:37:23:37:31 | UserToken |
72+
| jwtSimple.js:38:23:38:31 | UserToken |
73+
| jwtSimple.js:38:23:38:31 | UserToken |
74+
edges
75+
| JsonWebToken.js:13:11:13:47 | UserToken | JsonWebToken.js:16:28:16:36 | UserToken |
76+
| JsonWebToken.js:13:11:13:47 | UserToken | JsonWebToken.js:16:28:16:36 | UserToken |
77+
| JsonWebToken.js:13:23:13:47 | req.hea ... ization | JsonWebToken.js:13:11:13:47 | UserToken |
78+
| JsonWebToken.js:13:23:13:47 | req.hea ... ization | JsonWebToken.js:13:11:13:47 | UserToken |
79+
| JsonWebToken.js:20:11:20:47 | UserToken | JsonWebToken.js:23:28:23:36 | UserToken |
80+
| JsonWebToken.js:20:11:20:47 | UserToken | JsonWebToken.js:23:28:23:36 | UserToken |
81+
| JsonWebToken.js:20:11:20:47 | UserToken | JsonWebToken.js:24:28:24:36 | UserToken |
82+
| JsonWebToken.js:20:11:20:47 | UserToken | JsonWebToken.js:24:28:24:36 | UserToken |
83+
| JsonWebToken.js:20:23:20:47 | req.hea ... ization | JsonWebToken.js:20:11:20:47 | UserToken |
84+
| JsonWebToken.js:20:23:20:47 | req.hea ... ization | JsonWebToken.js:20:11:20:47 | UserToken |
85+
| JsonWebToken.js:28:11:28:47 | UserToken | JsonWebToken.js:31:28:31:36 | UserToken |
86+
| JsonWebToken.js:28:11:28:47 | UserToken | JsonWebToken.js:31:28:31:36 | UserToken |
87+
| JsonWebToken.js:28:23:28:47 | req.hea ... ization | JsonWebToken.js:28:11:28:47 | UserToken |
88+
| JsonWebToken.js:28:23:28:47 | req.hea ... ization | JsonWebToken.js:28:11:28:47 | UserToken |
89+
| JsonWebToken.js:35:11:35:47 | UserToken | JsonWebToken.js:38:28:38:36 | UserToken |
90+
| JsonWebToken.js:35:11:35:47 | UserToken | JsonWebToken.js:38:28:38:36 | UserToken |
91+
| JsonWebToken.js:35:11:35:47 | UserToken | JsonWebToken.js:39:28:39:36 | UserToken |
92+
| JsonWebToken.js:35:11:35:47 | UserToken | JsonWebToken.js:39:28:39:36 | UserToken |
93+
| JsonWebToken.js:35:23:35:47 | req.hea ... ization | JsonWebToken.js:35:11:35:47 | UserToken |
94+
| JsonWebToken.js:35:23:35:47 | req.hea ... ization | JsonWebToken.js:35:11:35:47 | UserToken |
95+
| JsonWebToken.js:43:11:43:47 | UserToken | JsonWebToken.js:46:28:46:36 | UserToken |
96+
| JsonWebToken.js:43:11:43:47 | UserToken | JsonWebToken.js:46:28:46:36 | UserToken |
97+
| JsonWebToken.js:43:11:43:47 | UserToken | JsonWebToken.js:47:28:47:36 | UserToken |
98+
| JsonWebToken.js:43:11:43:47 | UserToken | JsonWebToken.js:47:28:47:36 | UserToken |
99+
| JsonWebToken.js:43:23:43:47 | req.hea ... ization | JsonWebToken.js:43:11:43:47 | UserToken |
100+
| JsonWebToken.js:43:23:43:47 | req.hea ... ization | JsonWebToken.js:43:11:43:47 | UserToken |
101+
| jose.js:14:11:14:47 | UserToken | jose.js:16:20:16:28 | UserToken |
102+
| jose.js:14:11:14:47 | UserToken | jose.js:16:20:16:28 | UserToken |
103+
| jose.js:14:23:14:47 | req.hea ... ization | jose.js:14:11:14:47 | UserToken |
104+
| jose.js:14:23:14:47 | req.hea ... ization | jose.js:14:11:14:47 | UserToken |
105+
| jose.js:21:11:21:47 | UserToken | jose.js:23:26:23:34 | UserToken |
106+
| jose.js:21:11:21:47 | UserToken | jose.js:23:26:23:34 | UserToken |
107+
| jose.js:21:23:21:47 | req.hea ... ization | jose.js:21:11:21:47 | UserToken |
108+
| jose.js:21:23:21:47 | req.hea ... ization | jose.js:21:11:21:47 | UserToken |
109+
| jose.js:27:11:27:47 | UserToken | jose.js:29:20:29:28 | UserToken |
110+
| jose.js:27:11:27:47 | UserToken | jose.js:29:20:29:28 | UserToken |
111+
| jose.js:27:11:27:47 | UserToken | jose.js:30:26:30:34 | UserToken |
112+
| jose.js:27:11:27:47 | UserToken | jose.js:30:26:30:34 | UserToken |
113+
| jose.js:27:23:27:47 | req.hea ... ization | jose.js:27:11:27:47 | UserToken |
114+
| jose.js:27:23:27:47 | req.hea ... ization | jose.js:27:11:27:47 | UserToken |
115+
| jwtDecode.js:14:11:14:47 | UserToken | jwtDecode.js:18:16:18:24 | UserToken |
116+
| jwtDecode.js:14:11:14:47 | UserToken | jwtDecode.js:18:16:18:24 | UserToken |
117+
| jwtDecode.js:14:23:14:47 | req.hea ... ization | jwtDecode.js:14:11:14:47 | UserToken |
118+
| jwtDecode.js:14:23:14:47 | req.hea ... ization | jwtDecode.js:14:11:14:47 | UserToken |
119+
| jwtSimple.js:13:11:13:47 | UserToken | jwtSimple.js:18:23:18:31 | UserToken |
120+
| jwtSimple.js:13:11:13:47 | UserToken | jwtSimple.js:18:23:18:31 | UserToken |
121+
| jwtSimple.js:13:23:13:47 | req.hea ... ization | jwtSimple.js:13:11:13:47 | UserToken |
122+
| jwtSimple.js:13:23:13:47 | req.hea ... ization | jwtSimple.js:13:11:13:47 | UserToken |
123+
| jwtSimple.js:22:11:22:47 | UserToken | jwtSimple.js:27:23:27:31 | UserToken |
124+
| jwtSimple.js:22:11:22:47 | UserToken | jwtSimple.js:27:23:27:31 | UserToken |
125+
| jwtSimple.js:22:11:22:47 | UserToken | jwtSimple.js:28:23:28:31 | UserToken |
126+
| jwtSimple.js:22:11:22:47 | UserToken | jwtSimple.js:28:23:28:31 | UserToken |
127+
| jwtSimple.js:22:23:22:47 | req.hea ... ization | jwtSimple.js:22:11:22:47 | UserToken |
128+
| jwtSimple.js:22:23:22:47 | req.hea ... ization | jwtSimple.js:22:11:22:47 | UserToken |
129+
| jwtSimple.js:32:11:32:47 | UserToken | jwtSimple.js:37:23:37:31 | UserToken |
130+
| jwtSimple.js:32:11:32:47 | UserToken | jwtSimple.js:37:23:37:31 | UserToken |
131+
| jwtSimple.js:32:11:32:47 | UserToken | jwtSimple.js:38:23:38:31 | UserToken |
132+
| jwtSimple.js:32:11:32:47 | UserToken | jwtSimple.js:38:23:38:31 | UserToken |
133+
| jwtSimple.js:32:23:32:47 | req.hea ... ization | jwtSimple.js:32:11:32:47 | UserToken |
134+
| jwtSimple.js:32:23:32:47 | req.hea ... ization | jwtSimple.js:32:11:32:47 | UserToken |
135+
#select
136+
| JsonWebToken.js:13:23:13:47 | req.hea ... ization | JsonWebToken.js:13:23:13:47 | req.hea ... ization | JsonWebToken.js:16:28:16:36 | UserToken | Decoding JWT $@. | JsonWebToken.js:16:28:16:36 | UserToken | without signature verification |
137+
| JsonWebToken.js:20:23:20:47 | req.hea ... ization | JsonWebToken.js:20:23:20:47 | req.hea ... ization | JsonWebToken.js:23:28:23:36 | UserToken | Decoding JWT $@. | JsonWebToken.js:23:28:23:36 | UserToken | without signature verification |
138+
| JsonWebToken.js:20:23:20:47 | req.hea ... ization | JsonWebToken.js:20:23:20:47 | req.hea ... ization | JsonWebToken.js:24:28:24:36 | UserToken | Decoding JWT $@. | JsonWebToken.js:24:28:24:36 | UserToken | without signature verification |
139+
| jose.js:14:23:14:47 | req.hea ... ization | jose.js:14:23:14:47 | req.hea ... ization | jose.js:16:20:16:28 | UserToken | Decoding JWT $@. | jose.js:16:20:16:28 | UserToken | without signature verification |
140+
| jwtDecode.js:14:23:14:47 | req.hea ... ization | jwtDecode.js:14:23:14:47 | req.hea ... ization | jwtDecode.js:18:16:18:24 | UserToken | Decoding JWT $@. | jwtDecode.js:18:16:18:24 | UserToken | without signature verification |
141+
| jwtSimple.js:13:23:13:47 | req.hea ... ization | jwtSimple.js:13:23:13:47 | req.hea ... ization | jwtSimple.js:18:23:18:31 | UserToken | Decoding JWT $@. | jwtSimple.js:18:23:18:31 | UserToken | without signature verification |

‎javascript/ql/test/experimental/Security/CWE-347/decodeJwtWithoutVerification.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE-347/decodeJwtWithoutVerification.ql

0 commit comments

Comments
 (0)