@@ -42,26 +42,26 @@ private class JwtParserParseHandlerMethod extends Method {
4242}
4343
4444/** The `parse(token)`, `parseClaimsJwt(token)` and `parsePlaintextJwt(token)` methods defined in `JwtParser`. */
45- private class JwtParserInsecureParseMethods extends Method {
46- JwtParserInsecureParseMethods ( ) {
45+ private class JwtParserInsecureParseMethod extends Method {
46+ JwtParserInsecureParseMethod ( ) {
4747 this .hasName ( [ "parse" , "parseClaimsJwt" , "parsePlaintextJwt" ] ) and
4848 this .getNumberOfParameters ( ) = 1 and
4949 this .getDeclaringType ( ) instanceof TypeJwtParser
5050 }
5151}
5252
5353/** The `on(Claims|Plaintext)Jwt` methods defined in `JwtHandler`. */
54- private class JwtHandlerOnJwtMethods extends Method {
55- JwtHandlerOnJwtMethods ( ) {
54+ private class JwtHandlerOnJwtMethod extends Method {
55+ JwtHandlerOnJwtMethod ( ) {
5656 this .hasName ( [ "onClaimsJwt" , "onPlaintextJwt" ] ) and
5757 this .getNumberOfParameters ( ) = 1 and
5858 this .getDeclaringType ( ) instanceof TypeJwtHandler
5959 }
6060}
6161
6262/** The `on(Claims|Plaintext)Jwt` methods defined in `JwtHandlerAdapter`. */
63- private class JwtHandlerAdapterOnJwtMethods extends Method {
64- JwtHandlerAdapterOnJwtMethods ( ) {
63+ private class JwtHandlerAdapterOnJwtMethod extends Method {
64+ JwtHandlerAdapterOnJwtMethod ( ) {
6565 this .hasName ( [ "onClaimsJwt" , "onPlaintextJwt" ] ) and
6666 this .getNumberOfParameters ( ) = 1 and
6767 this .getDeclaringType ( ) instanceof TypeJwtHandlerAdapter
@@ -70,17 +70,17 @@ private class JwtHandlerAdapterOnJwtMethods extends Method {
7070
7171/**
7272 * Holds if `parseHandlerExpr` is an insecure `JwtHandler`.
73- * That is, it overrides a method from `JwtHandlerOnJwtMethods ` and the overridden method is not a method from `JwtHandlerAdapterOnJwtMethods `.
74- * A overridden method which is a method from `JwtHandlerAdapterOnJwtMethods ` is safe, because these always throw an exception.
73+ * That is, it overrides a method from `JwtHandlerOnJwtMethod ` and the overridden method is not a method from `JwtHandlerAdapterOnJwtMethod `.
74+ * A overridden method which is a method from `JwtHandlerAdapterOnJwtMethod ` is safe, because these always throw an exception.
7575 */
7676private predicate isInsecureParseHandler ( Expr parseHandlerExpr ) {
7777 exists ( RefType t |
7878 parseHandlerExpr .getType ( ) = t and
7979 t .getASourceSupertype * ( ) instanceof TypeJwtHandler and
8080 exists ( Method m |
8181 m = t .getAMethod ( ) and
82- m .getASourceOverriddenMethod + ( ) instanceof JwtHandlerOnJwtMethods and
83- not m .getSourceDeclaration ( ) instanceof JwtHandlerAdapterOnJwtMethods
82+ m .getASourceOverriddenMethod + ( ) instanceof JwtHandlerOnJwtMethod and
83+ not m .getSourceDeclaration ( ) instanceof JwtHandlerAdapterOnJwtMethod
8484 )
8585 )
8686}
@@ -92,7 +92,7 @@ private predicate isInsecureParseHandler(Expr parseHandlerExpr) {
9292 */
9393private class JwtParserInsecureParseMethodAccess extends MethodAccess {
9494 JwtParserInsecureParseMethodAccess ( ) {
95- this .getMethod ( ) .getASourceOverriddenMethod * ( ) instanceof JwtParserInsecureParseMethods
95+ this .getMethod ( ) .getASourceOverriddenMethod * ( ) instanceof JwtParserInsecureParseMethod
9696 or
9797 this .getMethod ( ) .getASourceOverriddenMethod * ( ) instanceof JwtParserParseHandlerMethod and
9898 isInsecureParseHandler ( this .getArgument ( 1 ) )
0 commit comments