Skip to content

Go: Add JWT Algorithm Confusion and JWT decoding without Signature Verification #14081

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Kwstubbs wants to merge 11 commits into from
Closed

Go: Add JWT Algorithm Confusion and JWT decoding without Signature Verification #14081

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
4f2d15e
Initial JWT Library
Kwstubbs Aug 25, 2023
fafdee5
Finish
Kwstubbs Aug 29, 2023
7730ad6
Finish
Kwstubbs Aug 29, 2023
8d2bc38
removed user files
Kwstubbs Aug 29, 2023
01a28eb
update docs
Kwstubbs Sep 5, 2023
1d6a805
Spelling
Kwstubbs Sep 5, 2023
ecbde43
Formatting and errors
Kwstubbs Sep 14, 2023
3a2b66e
change note
Kwstubbs Sep 14, 2023
1370bac
Big upgrade
Kwstubbs Sep 14, 2023
21fa77d
grammar
Kwstubbs Sep 14, 2023
84359fe
Finish
Kwstubbs Sep 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Finish
  • Loading branch information
@Kwstubbs
Kwstubbs committed Sep 14, 2023
commit 84359fe1a8523dd43e2ce5e6be8cef5a3a1510fc
4 changes: 4 additions & 0 deletions go/ql/lib/semmle/go/frameworks/JWT.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,18 @@ import go
* Provides models of commonly used functions in common JWT packages.
*/
module JWT {
/** Gets the package name `github.com/lestrrat-go/jwx` v2. */
string packageLestrrat() { result = package("github.com/lestrrat-go/jwx/v2/jwt", "") }
Comment thread
Kwstubbs marked this conversation as resolved.

/** Gets the package name `github.com/lestrrat-go/jwx` v1. */
string packageLestrratv1() { result = package("github.com/lestrrat-go/jwx/jwt", "") }
Comment thread
Kwstubbs marked this conversation as resolved.

/** Gets the package name `github.com/golang-jwt/jwt` v4 and v5. */
string packagePathModern() {
result = package(["github.com/golang-jwt/jwt/v5", "github.com/golang-jwt/jwt/v4"], "")
Comment thread
Kwstubbs marked this conversation as resolved.
}

/** Gets the package name `github.com/golang-jwt/jwt` v1 */
string packagePathOld() { result = package("github.com/golang-jwt/jwt", "") }

/**
Expand Down
5 changes: 5 additions & 0 deletions go/ql/src/change-notes/2023-09-13-JWT-signature-queries.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
category: newQuery
---
* Added JWT Confusion query `go/jwt-alg-confusion`
* Added JWT Parsing without Signature Check query `go/jwt-insecure-signing`
Comment thread
Kwstubbs marked this conversation as resolved.
5 changes: 1 addition & 4 deletions go/ql/test/experimental/CWE-347/JWTInsecureParsingLestrratv2.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ import (
"github.com/lestrrat-go/jwx/v2/jwt"
)

func ExampleJWT_Parse() {
func ExampleJWT_Parse2() {
jwkSymmetricKey, _ := jwk.FromRaw([]byte(`abracadabra`))
tok, err := jwt.NewBuilder().
Issuer(`github.com/lestrrat-go/jwx`).
Expand All @@ -35,6 +35,3 @@ func ExampleJWT_Parse() {
_ = tok
// OUTPUT:
}
func main() {
ExampleJWT_Parse()
}
3 changes: 0 additions & 3 deletions go/ql/test/experimental/CWE-347/JWTInsecureParsingLesttrat.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,3 @@ func ExampleJWT_Parse() {
_ = tok
// OUTPUT:
}
func main() {
ExampleJWT_Parse()
}