16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
106 lines
3.6 KiB
Plaintext
106 lines
3.6 KiB
Plaintext
== Why is this an issue?
|
|
|
|
include::../description.adoc[]
|
|
|
|
=== Noncompliant code example
|
|
|
|
For https://github.com/jpadilla/pyjwt[pyjwt] module:
|
|
|
|
[source,python]
|
|
----
|
|
jwt.decode(token, verify = False) # Noncompliant
|
|
jwt.decode(token, key, options={"verify_signature": False}) # Noncompliant
|
|
----
|
|
For https://github.com/davedoesdev/python-jwt[python_jwt] module:
|
|
|
|
[source,python]
|
|
----
|
|
jwt.process_jwt(token) # Noncompliant
|
|
----
|
|
|
|
=== Compliant solution
|
|
|
|
For https://github.com/jpadilla/pyjwt[pyjwt] module:
|
|
|
|
[source,python]
|
|
----
|
|
jwt.decode(token, key, algo)
|
|
----
|
|
For https://github.com/davedoesdev/python-jwt[python_jwt] module:
|
|
|
|
[source,python]
|
|
----
|
|
jwt.process_jwt(token) # Compliant because followed by verify_jwt()
|
|
jwt.verify_jwt(token, key, algo)
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 22 Feb 2021, 11:17:11 Pierre-Yves Nicolas wrote:
|
|
The first code example of the current description of the RSPEC links to https://github.com/GehirnInc/python-jwt but this is another JWT implementation.
|
|
|
|
There are multiple JWT implementations in Python with very similar names and they sometimes use the same namespace...
|
|
|
|
* PyJWT: https://github.com/jpadilla/pyjwt
|
|
https://pyjwt.readthedocs.io/en/latest/index.html[doc]
|
|
|
|
This is the one which matches the first code example of the current description.
|
|
|
|
https://pyjwt.readthedocs.io/en/latest/changelog.html#v2-0-0[Starting with version 2.0], the verify param of the decode function was dropped and replaced with
|
|
|
|
----
|
|
jwt.decode(encoded, key, options={"verify_signature": False}){code}
|
|
|
|
* [https://github.com/davedoesdev/python-jwt]
|
|
This is the one which has a process_jwt function.
|
|
{quote}From version 2.0.1 the namespace has changed from jwt to python_jwt, in order to avoid conflict with PyJWT.
|
|
{quote}
|
|
|
|
* [https://github.com/GehirnInc/python-jwt]
|
|
This implementation is wrongly linked in the current description of the ticket.
|
|
It's actually not covered by the current description of the RSPEC.
|
|
----
|
|
|
|
=== on 22 Feb 2021, 14:06:26 Pierre-Yves Nicolas wrote:
|
|
\[~hendrik.buchwald] Should we raise an issue on the following code?
|
|
|
|
----
|
|
try:
|
|
jwt.decode(token, key, algo)
|
|
except:
|
|
raise Exception("Invalid token")
|
|
----
|
|
Real world cases:
|
|
|
|
* \https://github.com/Bounties-Network/BountiesAPI/blob/7931957e56c9fcef574dd3a00ec5ab9a787a365c/bounties_api/user/middleware.py#L20
|
|
* \https://github.com/DragonComputer/Dragonfire/blob/dd21f8e88d9b6390bd229ff73f89a8c3c137b89c/dragonfire/api.py#L47
|
|
* \https://github.com/JeffVandrewJr/patron/blob/b2545066c8e57e398f4896eb9b25fb4e970e0f06/app/models.py#L125
|
|
|
|
=== on 22 Feb 2021, 17:31:35 Pierre-Yves Nicolas wrote:
|
|
\[~hendrik.buchwald] Shouldn't we drop the last part of the rule title ("with strong cipher algorithms") since we don't check the algorithm?
|
|
|
|
=== on 24 Feb 2021, 10:42:09 Hendrik Buchwald wrote:
|
|
\[~pierre-yves.nicolas] thanks, good catch! Luckily I only confused the links, the first one was supposed to be PyJWT (as that one is used much more often). I will change the name of the rule.
|
|
|
|
|
|
That are nice examples for the exceptions. While they are of course secure I think it might be fine to still raise this issue since there is no reason to not check for the right type of exception (e.g. ``++jwt.InvalidSignatureError++``). The intention of this specification is though to detect cases where the invalid signature exception is caught accidentally.
|
|
|
|
=== on 24 Feb 2021, 13:09:31 Hendrik Buchwald wrote:
|
|
I have removed the exception case for now.
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|