merge all JWT pkgs into one

Author: am0o0

javascript/ql/src/experimental/Security/CWE-347-noVerification/jsonWebToken.qll renamed to javascript/ql/src/experimental/Security/CWE-347-noVerification/JWT.qll

@@ -12,6 +12,18 @@ DataFlow::Node unverifiedDecode() {
         .mayHaveStringValue("none") and
     result = verify.getParameter(0).asSink()
   )
+  or
+  // jwt-simple
+  exists(API::Node n | n = API::moduleImport("jwt-simple").getMember("decode") |
+    n.getParameter(2).asSink().asExpr() = any(BoolLiteral b | b.getBoolValue() = true) and
+    result = n.getParameter(0).asSink()
+  )
+  or
+  // jwt-decode
+  result = API::moduleImport("jwt-decode").getParameter(0).asSink()
+  or
+  //jose
+  result = API::moduleImport("jose").getMember("decodeJwt").getParameter(0).asSink()
 }
 
 DataFlow::Node verifiedDecode() {
@@ -27,4 +39,16 @@ DataFlow::Node verifiedDecode() {
     ) and
     result = verify.getParameter(0).asSink()
   )
-}
+  or
+  // jwt-simple
+  exists(API::Node n | n = API::moduleImport("jwt-simple").getMember("decode") |
+    (
+      n.getParameter(2).asSink().asExpr() = any(BoolLiteral b | b.getBoolValue() = false) or
+      not exists(n.getParameter(2))
+    ) and
+    result = n.getParameter(0).asSink()
+    or
+    //jose
+    result = API::moduleImport("jose").getMember("jwtVerify").getParameter(0).asSink()
+  )
+}

javascript/ql/src/experimental/Security/CWE-347-noVerification/JsonWebToken.ql

@@ -12,7 +12,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import jsonWebToken
+import JWT
 
 class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "jsonwebtoken without any signature verification" }

javascript/ql/src/experimental/Security/CWE-347-noVerification/JsonWebTokenLocalSource.ql

@@ -12,7 +12,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import jsonWebToken
+import JWT
 
 class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "jsonwebtoken without any signature verification" }

javascript/ql/src/experimental/Security/CWE-347-noVerification/JsonWebTokenNotWorking.ql

@@ -12,7 +12,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import jsonWebToken
+import JWT
 
 class ConfigurationUnverifiedDecode extends TaintTracking::Configuration {
   ConfigurationUnverifiedDecode() { this = "jsonwebtoken without any signature verification" }