Skip to content

Golang : Add query to detect JWT signing vulnerabilities #9378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
smowton merged 11 commits into from Jun 2, 2022
Merged

Golang : Add query to detect JWT signing vulnerabilities #9378

Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
bd1ddc1
Golang : Add query to detect JWT signing vulnerabilities
May 30, 2022
e0f74a5
Include suggested changes from review.
May 31, 2022
ae2bc1b
Include suggested changes from review.
May 31, 2022
1ef42a1
Include suggested changes from review.
Jun 2, 2022
361b703
Include suggested changes from review.
Jun 2, 2022
bfbc1d4
Simplify redundant sanitizer
smowton Jun 2, 2022
3155771
Rename empty-string sanitizer to reflect what it actually does.
smowton Jun 2, 2022
b48a07e
Tighten up CompareExprSanitizer
smowton Jun 2, 2022
602495d
Replace cases accidentally handled by CompareExprSanitizer with Retur…
smowton Jun 2, 2022
e54b29a
Autoformat
smowton Jun 2, 2022
d5ac719
Remove duplicate function
smowton Jun 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Autoformat
  • Loading branch information
@smowton
smowton committed Jun 2, 2022
commit e54b29a84676c6dcfaa59240a6090a4c8029f91f
2 changes: 0 additions & 2 deletions go/ql/src/experimental/CWE-321/HardcodedKeysLib.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,7 +196,6 @@ module HardcodedKeys {
* contributing a dangerous hardcoded key.
*/
private class ReturnedAlongsideErrorSanitizerGuard extends Sanitizer {
Comment thread
This conversation was marked as resolved.

ReturnedAlongsideErrorSanitizerGuard() {
exists(ControlFlow::ConditionGuardNode guard, SsaWithFields errorVar, ReturnStmt r |
guard.ensuresNeq(errorVar.getAUse(), Builtin::nil().getARead()) and
Expand All @@ -205,7 +204,6 @@ module HardcodedKeys {
this.asExpr() = r.getExpr(0)
)
}

}

/** Mark any formatting string call as a sanitizer */
Expand Down