diff --git a/integration_tests/test_sonar_jwt_decode_verify.py b/integration_tests/test_sonar_jwt_decode_verify.py new file mode 100644 index 000000000..ac1d44f37 --- /dev/null +++ b/integration_tests/test_sonar_jwt_decode_verify.py @@ -0,0 +1,32 @@ +from core_codemods.sonar.sonar_jwt_decode_verify import ( + SonarJwtDecodeVerify, + JwtDecodeVerifySonarTransformer, +) +from codemodder.codemods.test import ( + BaseIntegrationTest, + original_and_expected_from_code_path, +) + + +class TestJwtDecodeVerify(BaseIntegrationTest): + codemod = SonarJwtDecodeVerify + code_path = "tests/samples/jwt_decode_verify.py" + original_code, expected_new_code = original_and_expected_from_code_path( + code_path, + [ + ( + 10, + """decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=True)\n""", + ), + ( + 11, + """decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], options={"verify_signature": True})\n""", + ), + ], + ) + sonar_issues_json = "tests/samples/sonar_issues.json" + + expected_diff = '--- \n+++ \n@@ -8,7 +8,7 @@\n \n encoded_jwt = jwt.encode(payload, SECRET_KEY, algorithm="HS256")\n \n-decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=False)\n-decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], options={"verify_signature": False})\n+decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=True)\n+decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], options={"verify_signature": True})\n \n var = "something"\n' + expected_line_change = "11" + num_changes = 2 + change_description = JwtDecodeVerifySonarTransformer.change_description diff --git a/src/codemodder/scripts/generate_docs.py b/src/codemodder/scripts/generate_docs.py index 88b256703..cce5e15e2 100644 --- a/src/codemodder/scripts/generate_docs.py +++ b/src/codemodder/scripts/generate_docs.py @@ -287,6 +287,11 @@ class DocMetadata: ].guidance_explained, need_sarif="Yes (Sonar)", ), + "jwt-decode-verify-S5659": DocMetadata( + importance=CORE_METADATA["jwt-decode-verify"].importance, + guidance_explained=CORE_METADATA["jwt-decode-verify"].guidance_explained, + need_sarif="Yes (Sonar)", + ), } diff --git a/src/core_codemods/__init__.py b/src/core_codemods/__init__.py index 86712f5f6..a7e721e52 100644 --- a/src/core_codemods/__init__.py +++ b/src/core_codemods/__init__.py @@ -63,6 +63,7 @@ from .str_concat_in_seq_literal import StrConcatInSeqLiteral from .fix_async_task_instantiation import FixAsyncTaskInstantiation from .django_model_without_dunder_str import DjangoModelWithoutDunderStr +from .sonar.sonar_jwt_decode_verify import SonarJwtDecodeVerify registry = CodemodCollection( origin="pixee", @@ -134,5 +135,6 @@ SonarRemoveAssertionInPytestRaises, SonarFlaskJsonResponseType, SonarDjangoJsonResponseType, + SonarJwtDecodeVerify, ], )