Skip to content

Go: Add JWT Algorithm Confusion and JWT decoding without Signature Verification #14081

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Kwstubbs wants to merge 11 commits into from
Closed

Go: Add JWT Algorithm Confusion and JWT decoding without Signature Verification #14081

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
4f2d15e
Initial JWT Library
Kwstubbs Aug 25, 2023
fafdee5
Finish
Kwstubbs Aug 29, 2023
7730ad6
Finish
Kwstubbs Aug 29, 2023
8d2bc38
removed user files
Kwstubbs Aug 29, 2023
01a28eb
update docs
Kwstubbs Sep 5, 2023
1d6a805
Spelling
Kwstubbs Sep 5, 2023
ecbde43
Formatting and errors
Kwstubbs Sep 14, 2023
3a2b66e
change note
Kwstubbs Sep 14, 2023
1370bac
Big upgrade
Kwstubbs Sep 14, 2023
21fa77d
grammar
Kwstubbs Sep 14, 2023
84359fe
Finish
Kwstubbs Sep 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
Prev Previous commit
Next Next commit
Finish
  • Loading branch information
@Kwstubbs
Kwstubbs committed Aug 29, 2023
commit 7730ad61cb3ac97d5f714d7e9b94d4207f917e40
15 changes: 12 additions & 3 deletions go/ql/lib/semmle/go/frameworks/JWT.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ string packageLestrrat() {
package("github.com/lestrrat-go/jwx/v2/jwt", "")

}
string packageLestrratv1() {
result =
package("github.com/lestrrat-go/jwx/jwt", "")
}
string packagePathModern() {
result =
package(["github.com/golang-jwt/jwt/v5", "github.com/golang-jwt/jwt/v4"], "")
Expand Down Expand Up @@ -51,9 +55,14 @@ string packagePathModern() {
this.hasQualifiedName(packageLestrrat(), "Parse")
}
}
Comment on lines +64 to +69
Copy link
Copy Markdown
Contributor

@owen-mc owen-mc Sep 22, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This model isn't used anywhere. Did you mean to use it somewhere? Or did you model it for completeness? Consider deleting - the model can easily be added in future if it is needed.

class LestrratSafeOptions extends Function{
LestrratSafeOptions() {
this.hasQualifiedName(packageLestrrat(), ["WithKey", "WithKeySet"])
class LestrratParsev1 extends Function{
LestrratParsev1() {
this.hasQualifiedName(packageLestrratv1(), "Parse")
}
}
class LestrratVerify extends Function {
LestrratVerify() {
this.hasQualifiedName(packageLestrratv1(), "WithVerify")
}
}
class LestrratParseInsecure extends Function{
Expand Down
20 changes: 20 additions & 0 deletions go/ql/src/Security/CWE-338/codeql_myfork.code-workspace
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
{
"folders": [
{
"path": "../../../../.."
},
{
"name": "[JWT_good__or_bad source archive]",
"uri": "codeql-zip-archive://0-44/Users/kstubbin/JWT/JWT_good__or_bad/src.zip"
},
{
"name": "[lestrrat-JWT source archive]",
"uri": "codeql-zip-archive://0-49/Users/kstubbin/lesstrat-JWT/lestrrat-JWT/src.zip"
},
{
"name": "[python source archive]",
"uri": "codeql-zip-archive://0-146/Users/kstubbin/Library/Application Support/Code/User/workspaceStorage/db72dba15c9beaace6cf497bdbee92ec/GitHub.vscode-codeql/redash/python/src.zip"
}
],
"settings": {}
}
Empty file removed go/ql/src/Security/CWE-347/InsecureJWTParsing.go
View file
Open in desktop
Empty file.
Empty file removed go/ql/src/Security/CWE-347/JWTParsing.qhelp
View file
Open in desktop
Empty file.
27 changes: 0 additions & 27 deletions go/ql/src/Security/CWE-347/JWTParsingSignature.ql
View file
Open in desktop

This file was deleted.

0 .../Security/CWE-347/JWTParsingAlgorithim.ql → ...mental/CWE-347/JWTParsingWIPAlgorithim.ql
View file
Open in desktop
File renamed without changes.
40 changes: 0 additions & 40 deletions go/ql/test/query-tests/Security/CWE-347/JWTInsecureParsingLestrrat.go
View file
Open in desktop

This file was deleted.

Empty file removed go/ql/test/query-tests/Security/CWE-347/JWTParsingAlgorithim.expected
View file
Open in desktop
Empty file.
1 change: 0 additions & 1 deletion go/ql/test/query-tests/Security/CWE-347/JWTParsingAlgorithim.qlref
View file
Open in desktop

This file was deleted.

Empty file removed go/ql/test/query-tests/Security/CWE-347/JWTParsingSignature.expected
View file
Open in desktop
Empty file.
1 change: 0 additions & 1 deletion go/ql/test/query-tests/Security/CWE-347/JWTParsingSignature.qlref
View file
Open in desktop

This file was deleted.

18 changes: 0 additions & 18 deletions go/ql/test/query-tests/Security/CWE-347/go.mod
View file
Open in desktop

This file was deleted.

17 changes: 0 additions & 17 deletions ...est/query-tests/Security/CWE-347/vendor/github.com/decred/dcrd/dcrec/secp256k1/v4/LICENSE
View file
Open in desktop

This file was deleted.

72 changes: 0 additions & 72 deletions ...sts/Security/CWE-347/vendor/github.com/decred/dcrd/dcrec/secp256k1/v4/README.md
View file
Open in desktop

This file was deleted.

18 changes: 0 additions & 18 deletions ...Security/CWE-347/vendor/github.com/decred/dcrd/dcrec/secp256k1/v4/compressedbytepoints.go
View file
Open in desktop

This file was deleted.

Loading