ast-grep-essentials/tests/javascript/express-jwt-hardcoded-secret-javascript-test.yml at main · coderabbitai/ast-grep-essentials · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
id: express-jwt-hardcoded-secret-javascript
valid:
  - |
    app.get('/ok-protected', jwt({ secret: process.env.SECRET }), function(req, res) {
    if (!req.user.admin) return res.sendStatus(401);
    res.sendStatus(200);
    });
invalid:
  - |
    var jwt = require('express-jwt');
    app.get('/protected', jwt({ secret: 'shhhhhhared-secret' }), function(req, res) {
    if (!req.user.admin) return res.sendStatus(401);
    res.sendStatus(200);
    });
  - |
     import express from 'express';
     import jwt from 'express-jwt';
     let hardcodedSecret1 = 'super-secret-key';
     app.get('/protected2', jwt({ secret: hardcodedSecret1 }), function(req, res) {
     if (!req.user.admin) return res.sendStatus(401);
     res.sendStatus(200);
     });
  - |
     import express from 'express';
     import jwt from 'express-jwt';
     const secret3 = 'static-secret';
     app.get('/protected4', jwt({ secret: secret3, issuer: 'http://issuer' }), function(req, res) {
     if (!req.user.admin) return res.sendStatus(401);
     res.sendStatus(200);
     });
  - |
     import express from 'express';
     import jwt from 'express-jwt';
     app.get('/protected1', jwt({ secret: 'super-secret-key' }), function(req, res) {
     if (!req.user.admin) return res.sendStatus(401);
     res.sendStatus(200);
     });
  - |
     import { expressJwt } from 'express-jwt';
     const secret4 = 'jwt-hardcoded-secret';
     app.get('/protected7', expressJwt({ secret: secret4 }), function(req, res) {
     if (!req.user.admin) return res.sendStatus(401);
     res.sendStatus(200);
     });