Skip to content

Commit 72e5226

Browse files
asgerfasgerf
committed
JS: Port experimental jwtDecodeWithoutVerification to ConfigSig
1 parent 7e162f5 commit 72e5226

File tree

2 files changed

+63
-168
lines changed

2 files changed

+63
-168
lines changed

‎javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,30 +11,29 @@
1111
*/
1212

1313
import javascript
14-
import DataFlow::PathGraph
1514
import JWT
1615

17-
class ConfigurationUnverifiedDecode extends TaintTracking::Configuration {
18-
ConfigurationUnverifiedDecode() { this = "jsonwebtoken without any signature verification" }
16+
module UnverifiedDecodeConfig implements DataFlow::ConfigSig {
17+
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
1918

20-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
21-
22-
override predicate isSink(DataFlow::Node sink) { sink = unverifiedDecode() }
19+
predicate isSink(DataFlow::Node sink) { sink = unverifiedDecode() }
2320
}
2421

25-
class ConfigurationVerifiedDecode extends TaintTracking::Configuration {
26-
ConfigurationVerifiedDecode() { this = "jsonwebtoken with signature verification" }
22+
module UnverifiedDecodeFlow = TaintTracking::Global<UnverifiedDecodeConfig>;
2723

28-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
24+
module VerifiedDecodeConfig implements DataFlow::ConfigSig {
25+
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
2926

30-
override predicate isSink(DataFlow::Node sink) { sink = verifiedDecode() }
27+
predicate isSink(DataFlow::Node sink) { sink = verifiedDecode() }
3128
}
3229

33-
from ConfigurationUnverifiedDecode cfg, DataFlow::PathNode source, DataFlow::PathNode sink
30+
module VerifiedDecodeFlow = TaintTracking::Global<VerifiedDecodeConfig>;
31+
32+
import UnverifiedDecodeFlow::PathGraph
33+
34+
from UnverifiedDecodeFlow::PathNode source, UnverifiedDecodeFlow::PathNode sink
3435
where
35-
cfg.hasFlowPath(source, sink) and
36-
not exists(ConfigurationVerifiedDecode cfg2 |
37-
cfg2.hasFlowPath(any(DataFlow::PathNode p | p.getNode() = source.getNode()), _)
38-
)
36+
UnverifiedDecodeFlow::flowPath(source, sink) and
37+
not VerifiedDecodeFlow::flow(source.getNode(), _)
3938
select source.getNode(), source, sink, "Decoding JWT $@.", sink.getNode(),
4039
"without signature verification"

‎javascript/ql/test/experimental/Security/CWE-347/remotesource/decodeJwtWithoutVerification.expected‎

Lines changed: 49 additions & 153 deletions
Original file line numberDiff line numberDiff line change
@@ -1,157 +1,53 @@
1-
nodes
2-
| JsonWebToken.js:10:11:10:47 | UserToken |
3-
| JsonWebToken.js:10:23:10:47 | req.hea ... ization |
4-
| JsonWebToken.js:10:23:10:47 | req.hea ... ization |
5-
| JsonWebToken.js:13:28:13:36 | UserToken |
6-
| JsonWebToken.js:13:28:13:36 | UserToken |
7-
| JsonWebToken.js:17:11:17:47 | UserToken |
8-
| JsonWebToken.js:17:23:17:47 | req.hea ... ization |
9-
| JsonWebToken.js:17:23:17:47 | req.hea ... ization |
10-
| JsonWebToken.js:20:28:20:36 | UserToken |
11-
| JsonWebToken.js:20:28:20:36 | UserToken |
12-
| JsonWebToken.js:21:28:21:36 | UserToken |
13-
| JsonWebToken.js:21:28:21:36 | UserToken |
14-
| JsonWebToken.js:25:11:25:47 | UserToken |
15-
| JsonWebToken.js:25:23:25:47 | req.hea ... ization |
16-
| JsonWebToken.js:25:23:25:47 | req.hea ... ization |
17-
| JsonWebToken.js:28:28:28:36 | UserToken |
18-
| JsonWebToken.js:28:28:28:36 | UserToken |
19-
| JsonWebToken.js:32:11:32:47 | UserToken |
20-
| JsonWebToken.js:32:11:32:47 | UserToken |
21-
| JsonWebToken.js:32:23:32:47 | req.hea ... ization |
22-
| JsonWebToken.js:32:23:32:47 | req.hea ... ization |
23-
| JsonWebToken.js:32:23:32:47 | req.hea ... ization |
24-
| JsonWebToken.js:32:23:32:47 | req.hea ... ization |
25-
| JsonWebToken.js:35:28:35:36 | UserToken |
26-
| JsonWebToken.js:35:28:35:36 | UserToken |
27-
| JsonWebToken.js:36:28:36:36 | UserToken |
28-
| JsonWebToken.js:36:28:36:36 | UserToken |
29-
| JsonWebToken.js:40:11:40:47 | UserToken |
30-
| JsonWebToken.js:40:11:40:47 | UserToken |
31-
| JsonWebToken.js:40:23:40:47 | req.hea ... ization |
32-
| JsonWebToken.js:40:23:40:47 | req.hea ... ization |
33-
| JsonWebToken.js:40:23:40:47 | req.hea ... ization |
34-
| JsonWebToken.js:40:23:40:47 | req.hea ... ization |
35-
| JsonWebToken.js:43:28:43:36 | UserToken |
36-
| JsonWebToken.js:43:28:43:36 | UserToken |
37-
| JsonWebToken.js:44:28:44:36 | UserToken |
38-
| JsonWebToken.js:44:28:44:36 | UserToken |
39-
| jose.js:11:11:11:47 | UserToken |
40-
| jose.js:11:23:11:47 | req.hea ... ization |
41-
| jose.js:11:23:11:47 | req.hea ... ization |
42-
| jose.js:13:20:13:28 | UserToken |
43-
| jose.js:13:20:13:28 | UserToken |
44-
| jose.js:18:11:18:47 | UserToken |
45-
| jose.js:18:23:18:47 | req.hea ... ization |
46-
| jose.js:18:23:18:47 | req.hea ... ization |
47-
| jose.js:20:26:20:34 | UserToken |
48-
| jose.js:20:26:20:34 | UserToken |
49-
| jose.js:24:11:24:47 | UserToken |
50-
| jose.js:24:11:24:47 | UserToken |
51-
| jose.js:24:23:24:47 | req.hea ... ization |
52-
| jose.js:24:23:24:47 | req.hea ... ization |
53-
| jose.js:24:23:24:47 | req.hea ... ization |
54-
| jose.js:24:23:24:47 | req.hea ... ization |
55-
| jose.js:26:20:26:28 | UserToken |
56-
| jose.js:26:20:26:28 | UserToken |
57-
| jose.js:27:26:27:34 | UserToken |
58-
| jose.js:27:26:27:34 | UserToken |
59-
| jwtDecode.js:11:11:11:47 | UserToken |
60-
| jwtDecode.js:11:23:11:47 | req.hea ... ization |
61-
| jwtDecode.js:11:23:11:47 | req.hea ... ization |
62-
| jwtDecode.js:15:16:15:24 | UserToken |
63-
| jwtDecode.js:15:16:15:24 | UserToken |
64-
| jwtSimple.js:10:11:10:47 | UserToken |
65-
| jwtSimple.js:10:23:10:47 | req.hea ... ization |
66-
| jwtSimple.js:10:23:10:47 | req.hea ... ization |
67-
| jwtSimple.js:13:23:13:31 | UserToken |
68-
| jwtSimple.js:13:23:13:31 | UserToken |
69-
| jwtSimple.js:17:11:17:47 | UserToken |
70-
| jwtSimple.js:17:23:17:47 | req.hea ... ization |
71-
| jwtSimple.js:17:23:17:47 | req.hea ... ization |
72-
| jwtSimple.js:20:23:20:31 | UserToken |
73-
| jwtSimple.js:20:23:20:31 | UserToken |
74-
| jwtSimple.js:21:23:21:31 | UserToken |
75-
| jwtSimple.js:21:23:21:31 | UserToken |
76-
| jwtSimple.js:25:11:25:47 | UserToken |
77-
| jwtSimple.js:25:11:25:47 | UserToken |
78-
| jwtSimple.js:25:23:25:47 | req.hea ... ization |
79-
| jwtSimple.js:25:23:25:47 | req.hea ... ization |
80-
| jwtSimple.js:25:23:25:47 | req.hea ... ization |
81-
| jwtSimple.js:25:23:25:47 | req.hea ... ization |
82-
| jwtSimple.js:28:23:28:31 | UserToken |
83-
| jwtSimple.js:28:23:28:31 | UserToken |
84-
| jwtSimple.js:29:23:29:31 | UserToken |
85-
| jwtSimple.js:29:23:29:31 | UserToken |
861
edges
87-
| JsonWebToken.js:10:11:10:47 | UserToken | JsonWebToken.js:13:28:13:36 | UserToken |
88-
| JsonWebToken.js:10:11:10:47 | UserToken | JsonWebToken.js:13:28:13:36 | UserToken |
89-
| JsonWebToken.js:10:23:10:47 | req.hea ... ization | JsonWebToken.js:10:11:10:47 | UserToken |
90-
| JsonWebToken.js:10:23:10:47 | req.hea ... ization | JsonWebToken.js:10:11:10:47 | UserToken |
91-
| JsonWebToken.js:17:11:17:47 | UserToken | JsonWebToken.js:20:28:20:36 | UserToken |
92-
| JsonWebToken.js:17:11:17:47 | UserToken | JsonWebToken.js:20:28:20:36 | UserToken |
93-
| JsonWebToken.js:17:11:17:47 | UserToken | JsonWebToken.js:21:28:21:36 | UserToken |
94-
| JsonWebToken.js:17:11:17:47 | UserToken | JsonWebToken.js:21:28:21:36 | UserToken |
95-
| JsonWebToken.js:17:23:17:47 | req.hea ... ization | JsonWebToken.js:17:11:17:47 | UserToken |
96-
| JsonWebToken.js:17:23:17:47 | req.hea ... ization | JsonWebToken.js:17:11:17:47 | UserToken |
97-
| JsonWebToken.js:25:11:25:47 | UserToken | JsonWebToken.js:28:28:28:36 | UserToken |
98-
| JsonWebToken.js:25:11:25:47 | UserToken | JsonWebToken.js:28:28:28:36 | UserToken |
99-
| JsonWebToken.js:25:23:25:47 | req.hea ... ization | JsonWebToken.js:25:11:25:47 | UserToken |
100-
| JsonWebToken.js:25:23:25:47 | req.hea ... ization | JsonWebToken.js:25:11:25:47 | UserToken |
101-
| JsonWebToken.js:32:11:32:47 | UserToken | JsonWebToken.js:35:28:35:36 | UserToken |
102-
| JsonWebToken.js:32:11:32:47 | UserToken | JsonWebToken.js:35:28:35:36 | UserToken |
103-
| JsonWebToken.js:32:11:32:47 | UserToken | JsonWebToken.js:36:28:36:36 | UserToken |
104-
| JsonWebToken.js:32:11:32:47 | UserToken | JsonWebToken.js:36:28:36:36 | UserToken |
105-
| JsonWebToken.js:32:23:32:47 | req.hea ... ization | JsonWebToken.js:32:11:32:47 | UserToken |
106-
| JsonWebToken.js:32:23:32:47 | req.hea ... ization | JsonWebToken.js:32:11:32:47 | UserToken |
107-
| JsonWebToken.js:32:23:32:47 | req.hea ... ization | JsonWebToken.js:32:11:32:47 | UserToken |
108-
| JsonWebToken.js:32:23:32:47 | req.hea ... ization | JsonWebToken.js:32:11:32:47 | UserToken |
109-
| JsonWebToken.js:40:11:40:47 | UserToken | JsonWebToken.js:43:28:43:36 | UserToken |
110-
| JsonWebToken.js:40:11:40:47 | UserToken | JsonWebToken.js:43:28:43:36 | UserToken |
111-
| JsonWebToken.js:40:11:40:47 | UserToken | JsonWebToken.js:44:28:44:36 | UserToken |
112-
| JsonWebToken.js:40:11:40:47 | UserToken | JsonWebToken.js:44:28:44:36 | UserToken |
113-
| JsonWebToken.js:40:23:40:47 | req.hea ... ization | JsonWebToken.js:40:11:40:47 | UserToken |
114-
| JsonWebToken.js:40:23:40:47 | req.hea ... ization | JsonWebToken.js:40:11:40:47 | UserToken |
115-
| JsonWebToken.js:40:23:40:47 | req.hea ... ization | JsonWebToken.js:40:11:40:47 | UserToken |
116-
| JsonWebToken.js:40:23:40:47 | req.hea ... ization | JsonWebToken.js:40:11:40:47 | UserToken |
117-
| jose.js:11:11:11:47 | UserToken | jose.js:13:20:13:28 | UserToken |
118-
| jose.js:11:11:11:47 | UserToken | jose.js:13:20:13:28 | UserToken |
119-
| jose.js:11:23:11:47 | req.hea ... ization | jose.js:11:11:11:47 | UserToken |
120-
| jose.js:11:23:11:47 | req.hea ... ization | jose.js:11:11:11:47 | UserToken |
121-
| jose.js:18:11:18:47 | UserToken | jose.js:20:26:20:34 | UserToken |
122-
| jose.js:18:11:18:47 | UserToken | jose.js:20:26:20:34 | UserToken |
123-
| jose.js:18:23:18:47 | req.hea ... ization | jose.js:18:11:18:47 | UserToken |
124-
| jose.js:18:23:18:47 | req.hea ... ization | jose.js:18:11:18:47 | UserToken |
125-
| jose.js:24:11:24:47 | UserToken | jose.js:26:20:26:28 | UserToken |
126-
| jose.js:24:11:24:47 | UserToken | jose.js:26:20:26:28 | UserToken |
127-
| jose.js:24:11:24:47 | UserToken | jose.js:27:26:27:34 | UserToken |
128-
| jose.js:24:11:24:47 | UserToken | jose.js:27:26:27:34 | UserToken |
129-
| jose.js:24:23:24:47 | req.hea ... ization | jose.js:24:11:24:47 | UserToken |
130-
| jose.js:24:23:24:47 | req.hea ... ization | jose.js:24:11:24:47 | UserToken |
131-
| jose.js:24:23:24:47 | req.hea ... ization | jose.js:24:11:24:47 | UserToken |
132-
| jose.js:24:23:24:47 | req.hea ... ization | jose.js:24:11:24:47 | UserToken |
133-
| jwtDecode.js:11:11:11:47 | UserToken | jwtDecode.js:15:16:15:24 | UserToken |
134-
| jwtDecode.js:11:11:11:47 | UserToken | jwtDecode.js:15:16:15:24 | UserToken |
135-
| jwtDecode.js:11:23:11:47 | req.hea ... ization | jwtDecode.js:11:11:11:47 | UserToken |
136-
| jwtDecode.js:11:23:11:47 | req.hea ... ization | jwtDecode.js:11:11:11:47 | UserToken |
137-
| jwtSimple.js:10:11:10:47 | UserToken | jwtSimple.js:13:23:13:31 | UserToken |
138-
| jwtSimple.js:10:11:10:47 | UserToken | jwtSimple.js:13:23:13:31 | UserToken |
139-
| jwtSimple.js:10:23:10:47 | req.hea ... ization | jwtSimple.js:10:11:10:47 | UserToken |
140-
| jwtSimple.js:10:23:10:47 | req.hea ... ization | jwtSimple.js:10:11:10:47 | UserToken |
141-
| jwtSimple.js:17:11:17:47 | UserToken | jwtSimple.js:20:23:20:31 | UserToken |
142-
| jwtSimple.js:17:11:17:47 | UserToken | jwtSimple.js:20:23:20:31 | UserToken |
143-
| jwtSimple.js:17:11:17:47 | UserToken | jwtSimple.js:21:23:21:31 | UserToken |
144-
| jwtSimple.js:17:11:17:47 | UserToken | jwtSimple.js:21:23:21:31 | UserToken |
145-
| jwtSimple.js:17:23:17:47 | req.hea ... ization | jwtSimple.js:17:11:17:47 | UserToken |
146-
| jwtSimple.js:17:23:17:47 | req.hea ... ization | jwtSimple.js:17:11:17:47 | UserToken |
147-
| jwtSimple.js:25:11:25:47 | UserToken | jwtSimple.js:28:23:28:31 | UserToken |
148-
| jwtSimple.js:25:11:25:47 | UserToken | jwtSimple.js:28:23:28:31 | UserToken |
149-
| jwtSimple.js:25:11:25:47 | UserToken | jwtSimple.js:29:23:29:31 | UserToken |
150-
| jwtSimple.js:25:11:25:47 | UserToken | jwtSimple.js:29:23:29:31 | UserToken |
151-
| jwtSimple.js:25:23:25:47 | req.hea ... ization | jwtSimple.js:25:11:25:47 | UserToken |
152-
| jwtSimple.js:25:23:25:47 | req.hea ... ization | jwtSimple.js:25:11:25:47 | UserToken |
153-
| jwtSimple.js:25:23:25:47 | req.hea ... ization | jwtSimple.js:25:11:25:47 | UserToken |
154-
| jwtSimple.js:25:23:25:47 | req.hea ... ization | jwtSimple.js:25:11:25:47 | UserToken |
2+
| JsonWebToken.js:10:11:10:47 | UserToken | JsonWebToken.js:13:28:13:36 | UserToken | provenance | |
3+
| JsonWebToken.js:10:23:10:47 | req.hea ... ization | JsonWebToken.js:10:11:10:47 | UserToken | provenance | |
4+
| JsonWebToken.js:17:11:17:47 | UserToken | JsonWebToken.js:20:28:20:36 | UserToken | provenance | |
5+
| JsonWebToken.js:17:11:17:47 | UserToken | JsonWebToken.js:21:28:21:36 | UserToken | provenance | |
6+
| JsonWebToken.js:17:23:17:47 | req.hea ... ization | JsonWebToken.js:17:11:17:47 | UserToken | provenance | |
7+
| JsonWebToken.js:32:11:32:47 | UserToken | JsonWebToken.js:35:28:35:36 | UserToken | provenance | |
8+
| JsonWebToken.js:32:23:32:47 | req.hea ... ization | JsonWebToken.js:32:11:32:47 | UserToken | provenance | |
9+
| JsonWebToken.js:40:11:40:47 | UserToken | JsonWebToken.js:43:28:43:36 | UserToken | provenance | |
10+
| JsonWebToken.js:40:23:40:47 | req.hea ... ization | JsonWebToken.js:40:11:40:47 | UserToken | provenance | |
11+
| jose.js:11:11:11:47 | UserToken | jose.js:13:20:13:28 | UserToken | provenance | |
12+
| jose.js:11:23:11:47 | req.hea ... ization | jose.js:11:11:11:47 | UserToken | provenance | |
13+
| jose.js:24:11:24:47 | UserToken | jose.js:26:20:26:28 | UserToken | provenance | |
14+
| jose.js:24:23:24:47 | req.hea ... ization | jose.js:24:11:24:47 | UserToken | provenance | |
15+
| jwtDecode.js:11:11:11:47 | UserToken | jwtDecode.js:15:16:15:24 | UserToken | provenance | |
16+
| jwtDecode.js:11:23:11:47 | req.hea ... ization | jwtDecode.js:11:11:11:47 | UserToken | provenance | |
17+
| jwtSimple.js:10:11:10:47 | UserToken | jwtSimple.js:13:23:13:31 | UserToken | provenance | |
18+
| jwtSimple.js:10:23:10:47 | req.hea ... ization | jwtSimple.js:10:11:10:47 | UserToken | provenance | |
19+
| jwtSimple.js:25:11:25:47 | UserToken | jwtSimple.js:28:23:28:31 | UserToken | provenance | |
20+
| jwtSimple.js:25:23:25:47 | req.hea ... ization | jwtSimple.js:25:11:25:47 | UserToken | provenance | |
21+
nodes
22+
| JsonWebToken.js:10:11:10:47 | UserToken | semmle.label | UserToken |
23+
| JsonWebToken.js:10:23:10:47 | req.hea ... ization | semmle.label | req.hea ... ization |
24+
| JsonWebToken.js:13:28:13:36 | UserToken | semmle.label | UserToken |
25+
| JsonWebToken.js:17:11:17:47 | UserToken | semmle.label | UserToken |
26+
| JsonWebToken.js:17:23:17:47 | req.hea ... ization | semmle.label | req.hea ... ization |
27+
| JsonWebToken.js:20:28:20:36 | UserToken | semmle.label | UserToken |
28+
| JsonWebToken.js:21:28:21:36 | UserToken | semmle.label | UserToken |
29+
| JsonWebToken.js:32:11:32:47 | UserToken | semmle.label | UserToken |
30+
| JsonWebToken.js:32:23:32:47 | req.hea ... ization | semmle.label | req.hea ... ization |
31+
| JsonWebToken.js:35:28:35:36 | UserToken | semmle.label | UserToken |
32+
| JsonWebToken.js:40:11:40:47 | UserToken | semmle.label | UserToken |
33+
| JsonWebToken.js:40:23:40:47 | req.hea ... ization | semmle.label | req.hea ... ization |
34+
| JsonWebToken.js:43:28:43:36 | UserToken | semmle.label | UserToken |
35+
| jose.js:11:11:11:47 | UserToken | semmle.label | UserToken |
36+
| jose.js:11:23:11:47 | req.hea ... ization | semmle.label | req.hea ... ization |
37+
| jose.js:13:20:13:28 | UserToken | semmle.label | UserToken |
38+
| jose.js:24:11:24:47 | UserToken | semmle.label | UserToken |
39+
| jose.js:24:23:24:47 | req.hea ... ization | semmle.label | req.hea ... ization |
40+
| jose.js:26:20:26:28 | UserToken | semmle.label | UserToken |
41+
| jwtDecode.js:11:11:11:47 | UserToken | semmle.label | UserToken |
42+
| jwtDecode.js:11:23:11:47 | req.hea ... ization | semmle.label | req.hea ... ization |
43+
| jwtDecode.js:15:16:15:24 | UserToken | semmle.label | UserToken |
44+
| jwtSimple.js:10:11:10:47 | UserToken | semmle.label | UserToken |
45+
| jwtSimple.js:10:23:10:47 | req.hea ... ization | semmle.label | req.hea ... ization |
46+
| jwtSimple.js:13:23:13:31 | UserToken | semmle.label | UserToken |
47+
| jwtSimple.js:25:11:25:47 | UserToken | semmle.label | UserToken |
48+
| jwtSimple.js:25:23:25:47 | req.hea ... ization | semmle.label | req.hea ... ization |
49+
| jwtSimple.js:28:23:28:31 | UserToken | semmle.label | UserToken |
50+
subpaths
15551
#select
15652
| JsonWebToken.js:10:23:10:47 | req.hea ... ization | JsonWebToken.js:10:23:10:47 | req.hea ... ization | JsonWebToken.js:13:28:13:36 | UserToken | Decoding JWT $@. | JsonWebToken.js:13:28:13:36 | UserToken | without signature verification |
15753
| JsonWebToken.js:17:23:17:47 | req.hea ... ization | JsonWebToken.js:17:23:17:47 | req.hea ... ization | JsonWebToken.js:20:28:20:36 | UserToken | Decoding JWT $@. | JsonWebToken.js:20:28:20:36 | UserToken | without signature verification |

0 commit comments

Comments
 (0)