Merge pull request github#12032 from egregius313/egregius313/promote-hardcoded-jwt-credential

Java: Promote Hardcoded JWT credential query

Author: egregius313

java/ql/lib/change-notes/2023-02-17-add-hardcoded-secret-for-jwt-tokens.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added new sinks for `java/hardcoded-credential-api-call` to identify the use of hardcoded secrets in the creation and verification of JWT tokens using `com.auth0.jwt`. These sinks are from [an experimental query submitted by @luchua](https://github.com/github/codeql/pull/9036).

java/ql/lib/semmle/code/java/security/SensitiveApi.qll

@@ -490,5 +490,11 @@ private predicate otherApiCallableCredentialParam(string s) {
       "com.microsoft.sqlserver.jdbc.SQLServerDataSource;setPassword(String);0",
       "com.microsoft.sqlserver.jdbc.SQLServerDataSource;getConnection(String, String);0",
       "com.microsoft.sqlserver.jdbc.SQLServerDataSource;getConnection(String, String);1",
+      "com.auth0.jwt.algorithms.Algorithm;HMAC256(String);0",
+      "com.auth0.jwt.algorithms.Algorithm;HMAC256(byte[]);0",
+      "com.auth0.jwt.algorithms.Algorithm;HMAC384(String);0",
+      "com.auth0.jwt.algorithms.Algorithm;HMAC384(byte[]);0",
+      "com.auth0.jwt.algorithms.Algorithm;HMAC512(String);0",
+      "com.auth0.jwt.algorithms.Algorithm;HMAC512(byte[]);0"
     ]
 }

java/ql/src/experimental/Security/CWE/CWE-321/HardcodedJwtKey.java

@@ -16,7 +16,7 @@ public class HardcodedJwtKey {
 
     // BAD: Get secret from hardcoded string then sign a JWT token
     public String accessTokenBad(String username) {
-        Algorithm algorithm = Algorithm.HMAC256(SECRET);
+        Algorithm algorithm = Algorithm.HMAC256(SECRET); // $ HardcodedCredentialsApiCall
 
         return JWT.create()
                 .withExpiresAt(new Date(new Date().getTime() + ACCESS_EXPIRE_TIME))
@@ -39,7 +39,7 @@ public String accessTokenGood(String username) {
 
     // BAD: Get secret from hardcoded string then verify a JWT token
     public boolean verifyTokenBad(String token) {
-        JWTVerifier verifier = JWT.require(Algorithm.HMAC256(SECRET))
+        JWTVerifier verifier = JWT.require(Algorithm.HMAC256(SECRET)) // $ HardcodedCredentialsApiCall
                 .withIssuer(ISSUER)
                 .build();
         try {
@@ -62,4 +62,49 @@ public boolean verifyTokenGood(String token) {
             return false;
         }
     }
+
+    public String accessTokenBad384(String username) {
+        Algorithm algorithm = Algorithm.HMAC384(SECRET); // $ HardcodedCredentialsApiCall
+
+        return JWT.create()
+                .withExpiresAt(new Date(new Date().getTime() + ACCESS_EXPIRE_TIME))
+                .withIssuer(ISSUER)
+                .withClaim("username", username)
+                .sign(algorithm);
+    }
+
+    // GOOD: Get secret from system configuration then sign a token
+    public String accessTokenGood384(String username) {
+        String tokenSecret = System.getenv("SECRET_KEY");
+        Algorithm algorithm = Algorithm.HMAC384(tokenSecret);
+
+        return JWT.create()
+                .withExpiresAt(new Date(new Date().getTime() + ACCESS_EXPIRE_TIME))
+                .withIssuer(ISSUER)
+                .withClaim("username", username)
+                .sign(algorithm);
+    }
+
+    public String accessTokenBad512(String username) {
+        Algorithm algorithm = Algorithm.HMAC512(SECRET); // $ HardcodedCredentialsApiCall
+
+        return JWT.create()
+                .withExpiresAt(new Date(new Date().getTime() + ACCESS_EXPIRE_TIME))
+                .withIssuer(ISSUER)
+                .withClaim("username", username)
+                .sign(algorithm);
+    }
+
+    // GOOD: Get secret from system configuration then sign a token
+    public String accessTokenGood512(String username) {
+        String tokenSecret = System.getenv("SECRET_KEY");
+        Algorithm algorithm = Algorithm.HMAC512(tokenSecret);
+
+        return JWT.create()
+                .withExpiresAt(new Date(new Date().getTime() + ACCESS_EXPIRE_TIME))
+                .withIssuer(ISSUER)
+                .withClaim("username", username)
+                .sign(algorithm);
+    }
+
 }