[Java] JWT without signature check.

[intrigus-lgtm]

This query detects cases where a signing key is for a JwtParser, but a parsing method is used that does not verify the signature using the signing key.

[Marcono1234]

That is a pretty neat query!
I have left some review comments regarding documentation and naming, but feel free to ignore those. The maintainers will probably give you more valuable feedback.

[JarLob]

Hey @intrigus-lgtm,
It looks like the pattern is popular in tests. Could you please add a statement to exclude results from **/test/** path?

[intrigus-lgtm]

Hey @intrigus-lgtm,
It looks like the pattern is popular in tests. Could you please add a statement to exclude results from **/test/** path?

I always thought that this should not be done in ql but in the "presentation layer"?
At least I have a faint memory of reading that somewhere.

[JarLob]

I also had doubts and asked Java CodeQL team for advise and we decided to add the filtering for now, it can be removed later if the query is promoted from experimental.

[intrigus-lgtm]

@JarLob done in 231b077.

[intrigus-lgtm]

Hi @tamasvajk it looks like you have been assigned to review this.
Just a friendly ping in case this fell through the cracks.

I hope that the PR is in a state in which it needs few changes :)

[JarLob]

@intrigus-lgtm The corresponding issue is in SecLab review stage, so I have asked for the changes. It will take time to rerun the LGTM query. Not sure about the PR.

[smowton]

I note the stubs are not in fact stubs -- they largely have method bodies etc

[intrigus-lgtm]

I note the stubs are not in fact stubs -- they largely have method bodies etc

You're right.
I will remove all method bodies.
Is there anything else I should remove?

[smowton]

Private fields, nontrivial field initialisers, any imports and classes that are no longer necessary after stubbing

[intrigus-lgtm]

@smowton done in a8865e2.