Make verifiesSignature() a predicate

Author: jorgectf

python/ql/src/experimental/Security/CWE-347/JWTMissingSecretOrPublicKeyVerification.ql

@@ -13,5 +13,5 @@ import python
 import experimental.semmle.python.Concepts
 
 from JWTDecoding jwtDecoding
-where jwtDecoding.verifiesSignature() = false
-select jwtDecoding, "does not verify the JWT payload with a cryptographic secret or public key."
+where not jwtDecoding.verifiesSignature()
+select jwtDecoding.getPayload(), "is not verified with a cryptographic secret or public key."

python/ql/src/experimental/semmle/python/Concepts.qll

@@ -247,7 +247,7 @@ module JWTDecoding {
     /**
      * Checks if the signature gets verified while decoding.
      */
-    abstract boolean verifiesSignature();
+    abstract predicate verifiesSignature();
   }
 }
 
@@ -290,5 +290,5 @@ class JWTDecoding extends DataFlow::Node {
   /**
    * Checks if the signature gets verified while decoding.
    */
-  boolean verifiesSignature() { result = range.verifiesSignature() }
+  predicate verifiesSignature() { range.verifiesSignature() }
 }

python/ql/src/experimental/semmle/python/frameworks/JWT.qll

@@ -72,23 +72,19 @@ private module JWT {
       result in [this.getArg(3), this.getArgByName("options")]
     }
 
-    override boolean verifiesSignature() {
+    override predicate verifiesSignature() {
       // jwt.decode(token, "key", "HS256")
-      not exists(this.getArgByName("verify")) and not exists(this.getOptions()) and result = true
+      not exists(this.getArgByName("verify")) and not exists(this.getOptions())
       or
-      (
-        // not -> jwt.decode(token, verify=False)
-        isFalse(this.getArgByName("verify"))
-        or
-        // not -> jwt.decode(token, key, options={"verify_signature": False})
-        exists(KeyValuePair optionsDict, NameConstant falseName |
-          falseName.getId() = "False" and
-          optionsDict = this.getArgByName("options").asExpr().(Dict).getItems().getAnItem() and
-          optionsDict.getKey().(Str_).getS().matches("%verify%") and
-          falseName = optionsDict.getValue()
-        )
-      ) and
-      result = false
+      // jwt.decode(token, verify=False)
+      not isFalse(this.getArgByName("verify")) and
+      // not -> jwt.decode(token, key, options={"verify_signature": False})
+      not exists(KeyValuePair optionsDict, NameConstant falseName |
+        falseName.getId() = "False" and
+        optionsDict = this.getArgByName("options").asExpr().(Dict).getItems().getAnItem() and
+        optionsDict.getKey().(Str_).getS().matches("%verify%") and
+        falseName = optionsDict.getValue()
+      )
     }
   }
 }