55 * @problem.severity error
66 * @security-severity 7.8
77 * @precision high
8- * @id java/missing-jwt-signature-check
8+ * @id java/missing-jwt-signature-check-auth0
99 * @tags security
1010 * external/cwe/cwe-347
1111 */
@@ -22,14 +22,14 @@ module JwtAuth0 {
2222 JwtType ( ) { this .hasQualifiedName ( "com.auth0.jwt" , "JWT" ) }
2323 }
2424
25- class JwtVerifierType extends RefType {
26- JwtVerifierType ( ) { this .hasQualifiedName ( "com.auth0.jwt" , "JWTVerifier" ) }
25+ class JwtVerifierType extends RefType {
26+ JwtVerifierType ( ) { this .hasQualifiedName ( "com.auth0.jwt" , "JWTVerifier" ) }
2727 }
2828
2929 /**
3030 * A Method that returns a Decoded Claim of JWT
3131 */
32- class GetPayload extends MethodAccess {
32+ class GetPayload extends MethodCall {
3333 GetPayload ( ) {
3434 this .getCallee ( ) .getDeclaringType ( ) instanceof PayloadType and
3535 this .getCallee ( ) .hasName ( [ "getClaim" , "getIssuedAt" ] )
@@ -39,7 +39,7 @@ module JwtAuth0 {
3939 /**
4040 * A Method that Decode JWT without signature verification
4141 */
42- class Decode extends MethodAccess {
42+ class Decode extends MethodCall {
4343 Decode ( ) {
4444 this .getCallee ( ) .getDeclaringType ( ) instanceof JwtType and
4545 this .getCallee ( ) .hasName ( "decode" )
@@ -49,9 +49,9 @@ module JwtAuth0 {
4949 /**
5050 * A Method that Decode JWT with signature verification
5151 */
52- class Verify extends MethodAccess {
52+ class Verify extends MethodCall {
5353 Verify ( ) {
54- this .getCallee ( ) .getDeclaringType ( ) instanceof JwtVerifierType and
54+ this .getCallee ( ) .getDeclaringType ( ) instanceof JwtVerifierType and
5555 this .getCallee ( ) .hasName ( "verify" )
5656 }
5757 }
0 commit comments