apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/dotnet/jwt_config_extractor.py

@@ -0,0 +1,545 @@
+"""
+.NET JWT configuration extractor for ASP.NET Core framework plugin.
+
+Mirrors the structure of JavaJwtConfigExtractor so the two can be maintained
+in parallel.  Detection strategy:
+
+1. Library   — identified from using/import prefixes.
+2. Algorithms — extracted from SecurityAlgorithms.HmacSha256 references,
+               TokenValidationParameters.ValidAlgorithms assignments, and
+               string literals matching known JWA names.
+3. Validation flags — inferred from TokenValidationParameters property
+               assignments (ValidateIssuerSigningKey, ValidateLifetime,
+               ValidateIssuer, ValidateAudience).
+4. Secret source — "env" from Environment.GetEnvironmentVariable(),
+               "config" from IConfiguration["jwt:secret"] / appsettings keys,
+               "hardcoded" from literal strings passed to signing helpers or
+               stored in string fields whose names contain a secret keyword.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from ...parsing.base import ParsedFile
+from .._jwt_common import add_algorithm as _add_algorithm
+from .._jwt_common import normalize_algorithm as _normalize_alg
+from ..base import ExtractedJwtConfig
+
+# ---------------------------------------------------------------------------
+# Library detection
+# ---------------------------------------------------------------------------
+
+_JWT_IMPORT_PREFIXES: dict[str, str] = {
+    "Microsoft.IdentityModel.Tokens": "microsoft-identity-model",
+    "System.IdentityModel.Tokens.Jwt": "system-identitymodel-jwt",
+    "Microsoft.AspNetCore.Authentication.JwtBearer": "aspnetcore-jwt-bearer",
+    "Microsoft.AspNetCore.Authorization": "aspnetcore-authorization",
+    "JWT": "jwt-net",  # JWT.net (joakimskoog/jwt)
+    "Jose": "jose-jwt",  # jose-jwt
+    "System.Security.Cryptography": "dotnet-crypto",
+}
+
+_JWT_CLASS_NAMES: frozenset[str] = frozenset(
+    {
+        "JwtSecurityToken",
+        "JwtSecurityTokenHandler",
+        "SecurityToken",
+        "TokenValidationParameters",
+        "JwtBearerOptions",
+        "JwtRegisteredClaimNames",
+        "SigningCredentials",
+        "SymmetricSecurityKey",
+    }
+)
+
+# ---------------------------------------------------------------------------
+# Algorithm aliases  (canonical JWA set lives in frameworks/_jwt_common.py)
+# ---------------------------------------------------------------------------
+
+# SecurityAlgorithms constants  →  JWA name
+_ALGORITHM_ALIASES: dict[str, str] = {
+    # HMAC-SHA variants
+    "HMACSHA256": "HS256",
+    "HMACSHA384": "HS384",
+    "HMACSHA512": "HS512",
+    # SecurityAlgorithms static field names
+    "HMACSHA256SIGNATURE": "HS256",
+    "HMACSHA384SIGNATURE": "HS384",
+    "HMACSHA512SIGNATURE": "HS512",
+    "RSASHA256": "RS256",
+    "RSASHA384": "RS384",
+    "RSASHA512": "RS512",
+    "RSASSHA256": "RS256",
+    "ECDSASHA256": "ES256",
+    "ECDSASHA384": "ES384",
+    "ECDSASHA512": "ES512",
+    # String forms sometimes used directly
+    "HTTP://WWW.W3.ORG/2001/04/XMLDSIG-MORE#HMAC-SHA256": "HS256",
+}
+
+# ---------------------------------------------------------------------------
+# Call-site keyword sets
+# ---------------------------------------------------------------------------
+
+_PARSE_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "validatetoken",
+        "readtoken",
+        "readjwttoken",
+        "canreadtoken",
+        "validatejwt",
+        "decode",
+    }
+)
+
+_SIGN_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "signingcredentials",
+        "addsigningkey",
+        "withalgorithm",
+        "setsigningkey",
+        "signingkey",
+    }
+)
+
+_EXPIRY_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "validatelifetime",
+        "clockskew",
+        "setexpiry",
+        "notbefore",
+        "expires",
+        "expiresat",
+    }
+)
+
+_ISSUER_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "validateissuer",
+        "validissuer",
+        "validissuers",
+        "issuer",
+        "setissuer",
+    }
+)
+
+_AUDIENCE_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "validateaudience",
+        "validaudience",
+        "validaudiences",
+        "audience",
+        "setaudience",
+    }
+)
+
+# ---------------------------------------------------------------------------
+# Secret detection
+# ---------------------------------------------------------------------------
+
+_SECRET_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "jwt",
+        "secret",
+        "signing",
+        "signkey",
+        "token",
+        "key",
+        "password",
+        "credential",
+    }
+)
+
+_VALUE_RE = re.compile(r'["\']((?:jwt|secret|signing|key|token)[^"\']{0,40})["\']', re.IGNORECASE)
+_CONFIG_RE = re.compile(
+    r'(?:configuration|config|_config|IConfiguration)\s*(?:\[|\.GetValue[^(]*\()\s*["\']([^"\']+)["\']',
+    re.IGNORECASE,
+)
+_GETENV_RE = re.compile(r'GetEnvironmentVariable\s*\(\s*["\']([^"\']+)["\']\s*\)')
+
+
+def _normalize_algorithm(raw: str) -> str | None:
+    """Return JWA algorithm name or None if unrecognised."""
+    return _normalize_alg(raw, _ALGORITHM_ALIASES)
+
+
+# ---------------------------------------------------------------------------
+# Main extractor
+# ---------------------------------------------------------------------------
+
+
+class DotNetJwtConfigExtractor:
+    """
+    Extracts JWT configuration from a single parsed C# file.
+
+    ASP.NET Core plugin instantiates this once and calls ``extract(parsed_file)``.
+    """
+
+    EXTRA_IMPORT_PREFIXES: dict[str, str] = {}
+
+    def extract(self, parsed_file: ParsedFile) -> ExtractedJwtConfig | None:  # noqa: C901
+        jwt_config = ExtractedJwtConfig(library="", detected=False)
+
+        # ── 1. Library detection ──────────────────────────────────────────
+        all_prefixes = {**_JWT_IMPORT_PREFIXES, **self.EXTRA_IMPORT_PREFIXES}
+
+        for imp in parsed_file.imports:
+            module = imp.module or ""
+            for prefix, lib_name in all_prefixes.items():
+                if module.startswith(prefix):
+                    jwt_config.detected = True
+                    jwt_config.library = jwt_config.library or lib_name
+                    break
+
+            for name in imp.names:
+                if name in _JWT_CLASS_NAMES and not jwt_config.detected:
+                    jwt_config.detected = True
+                    jwt_config.library = jwt_config.library or "aspnetcore-jwt-bearer"
+
+        if not jwt_config.detected:
+            return None
+
+        # ASP.NET Core JWT bearer validates signature + expiry by default
+        if "aspnetcore" in jwt_config.library or "microsoft-identity" in jwt_config.library:
+            jwt_config.validates_signature = True
+            jwt_config.validates_expiry = True
+
+        # ── 2. Call-site analysis ─────────────────────────────────────────
+        for call in parsed_file.call_sites:
+            callee = call.callee_name.lower()
+
+            # Parse / validate → JWT is consumed here
+            if any(kw in callee for kw in _PARSE_KEYWORDS):
+                jwt_config.locations.append(call.location)
+                jwt_config.validates_signature = True
+
+            # Algorithm detection via method name
+            if any(kw in callee for kw in _SIGN_KEYWORDS):
+                # Collect algo from callee suffix (e.g. "SecurityAlgorithms.HmacSha256")
+                algo = _normalize_algorithm(call.callee_name.split(".")[-1])
+                if algo:
+                    _add_algorithm(algo, jwt_config)
+
+            # SecurityAlgorithms.HmacSha256 used as a standalone reference
+            algo_from_callee = _normalize_algorithm(call.callee_name.split(".")[-1])
+            if algo_from_callee:
+                _add_algorithm(algo_from_callee, jwt_config)
+
+            # Validation flags
+            if any(kw in callee for kw in _EXPIRY_KEYWORDS):
+                jwt_config.validates_expiry = True
+            if any(kw in callee for kw in _ISSUER_KEYWORDS):
+                jwt_config.validates_issuer = True
+            if any(kw in callee for kw in _AUDIENCE_KEYWORDS):
+                jwt_config.validates_audience = True
+
+            # Environment variable secret
+            if "getenvironmentvariable" in callee and jwt_config.secret_source is None:
+                pass  # handled in field scan below via regex
+
+        # ── 3. Field / property annotation scan ──────────────────────────
+        if jwt_config.secret_source is None:
+            self._scan_fields(parsed_file, jwt_config)
+
+        # ── 4. Static / const string fields with literal values ───────────
+        if jwt_config.secret_source is None:
+            self._scan_static_fields(parsed_file, jwt_config)
+
+        # ── 5. TokenValidationParameters property assignments in field text ─
+        self._scan_validation_assignments(parsed_file, jwt_config)
+
+        # ── 6. SecurityAlgorithms member references (field/property, not calls) ─
+        self._scan_security_algorithms_refs(parsed_file, jwt_config)
+
+        # ── 7. AddJwtBearer(config => { ... }) lambda bodies ────────────────
+        # In minimal-hosting Program.cs the JWT config sits at module scope,
+        # outside any class.  The C# parser captures the AddJwtBearer call
+        # site but doesn't expose the lambda body — read it from disk and
+        # apply the same regex patterns the in-method scan uses.
+        self._scan_addjwtbearer_lambda_bodies(parsed_file, jwt_config)
+
+        return jwt_config
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    def _scan_fields(self, parsed_file: ParsedFile, jwt_config: ExtractedJwtConfig) -> None:
+        """
+        Scan field default values for:
+        - Environment.GetEnvironmentVariable("JWT_SECRET")
+        - configuration["jwt:secret"]  /  _config.GetValue<string>("...")
+        """
+        for cls in parsed_file.classes:
+            for f in cls.fields:
+                dv = getattr(f, "default_value", None) or ""
+
+                # Environment variable
+                m = _GETENV_RE.search(dv)
+                if m:
+                    val = m.group(1)
+                    if any(kw in val.lower() for kw in _SECRET_KEYWORDS):
+                        jwt_config.secret_source = "env"
+                        jwt_config.secret_name = val
+                        return
+
+                # Configuration key
+                m2 = _CONFIG_RE.search(dv)
+                if m2:
+                    key = m2.group(1)
+                    if any(kw in key.lower() for kw in _SECRET_KEYWORDS):
+                        jwt_config.secret_source = "config"
+                        jwt_config.secret_name = key
+                        return
+
+            # Also check [FromConfiguration] / [SecretName] decorators on fields
+            for f in cls.fields:
+                for dec in getattr(f, "decorators", None) or []:
+                    if dec.name in ("ConfigurationValue", "SecretName", "Value"):
+                        raw = (
+                            dec.positional_args[0]
+                            if dec.positional_args
+                            else (dec.arguments.get("value") or dec.arguments.get("Value"))
+                        )
+                        if raw and isinstance(raw, str):
+                            if any(kw in raw.lower() for kw in _SECRET_KEYWORDS):
+                                jwt_config.secret_source = "config"
+                                jwt_config.secret_name = raw
+                                return
+
+    def _scan_static_fields(self, parsed_file: ParsedFile, jwt_config: ExtractedJwtConfig) -> None:
+        """Detect private const/static string fields with literal secret values.
+
+        The C# parser strips quote characters from string literals (via
+        _string_literal_value), so default_value contains the bare content
+        without surrounding quotes.  We accept both quoted (Java-style raw
+        default_value) and unquoted (C# parser output) forms.
+
+        A value is treated as a literal — not an expression — when it contains
+        no parentheses (which would indicate a function call) and no ``${``
+        (Spring-style placeholder).
+        """
+        _quoted_re = re.compile(r'^["\'](.{4,})["\']$')
+        for cls in parsed_file.classes:
+            for f in cls.fields:
+                if not any(kw in (f.name or "").lower() for kw in _SECRET_KEYWORDS):
+                    continue
+                dv = (getattr(f, "default_value", None) or "").strip()
+                if not dv or len(dv) < 4:
+                    continue
+                # Quoted form (Java parser keeps surrounding quotes)
+                if _quoted_re.match(dv):
+                    jwt_config.secret_source = "hardcoded"
+                    jwt_config.secret_name = f.name
+                    return
+                # Unquoted form (C# parser already stripped quotes) — exclude
+                # anything that looks like an expression (function call, property
+                # access placeholder, etc.)
+                if "(" not in dv and "${" not in dv:
+                    jwt_config.secret_source = "hardcoded"
+                    jwt_config.secret_name = f.name
+                    return
+
+    # SecurityAlgorithms.HmacSha256 / SecurityAlgorithms.RsaSha256 are field
+    # references, not method calls — they don't appear in call_sites.
+    _SECURITY_ALGO_RE = re.compile(
+        r"SecurityAlgorithms\."
+        r"(Hmac(?:Sha256|Sha384|Sha512)"
+        r"|Rsa(?:Sha256|Sha384|Sha512)"
+        r"|EcDsa(?:Sha256|Sha384|Sha512)"
+        r"|(?:HS|RS|ES|PS)(?:256|384|512))",
+        re.IGNORECASE,
+    )
+
+    # Human-readable SecurityAlgorithms field name → JWA
+    _SEC_ALGO_MAP: dict[str, str] = {
+        "hmacsha256": "HS256",
+        "hmacsha384": "HS384",
+        "hmacsha512": "HS512",
+        "rsasha256": "RS256",
+        "rsasha384": "RS384",
+        "rsasha512": "RS512",
+        "ecdsasha256": "ES256",
+        "ecdsasha384": "ES384",
+        "ecdsasha512": "ES512",
+    }
+
+    def _scan_security_algorithms_refs(
+        self, parsed_file: ParsedFile, jwt_config: ExtractedJwtConfig
+    ) -> None:
+        """
+        Scan field initializers and method call names for SecurityAlgorithms.*
+        references that indicate which signing algorithm is in use.
+
+        ``SecurityAlgorithms.HmacSha256`` is a constant string field, not a
+        method — it won't appear in ``call_sites``.  We match it with a regex
+        over field default_values and the call site callee names.
+        """
+        # Check call_sites: new SigningCredentials(key, SecurityAlgorithms.HmacSha256)
+        # appears as callee "SecurityAlgorithms.HmacSha256" when captured via
+        # object_creation_expression arguments (future enhancement) or via the
+        # callee of an invocation. Also check for the pattern in callee names.
+        for call in parsed_file.call_sites:
+            m = self._SECURITY_ALGO_RE.search(call.callee_name)
+            if m:
+                raw = m.group(1).lower().replace("_", "")
+                algo = self._SEC_ALGO_MAP.get(raw) or _normalize_algorithm(raw)
+                if algo:
+                    _add_algorithm(algo, jwt_config)
+
+        # Check field default values (e.g. const string algo = SecurityAlgorithms.HmacSha256)
+        for cls in parsed_file.classes:
+            for f in cls.fields:
+                dv = getattr(f, "default_value", None) or ""
+                m = self._SECURITY_ALGO_RE.search(dv)
+                if m:
+                    raw = m.group(1).lower().replace("_", "")
+                    algo = self._SEC_ALGO_MAP.get(raw) or _normalize_algorithm(raw)
+                    if algo:
+                        _add_algorithm(algo, jwt_config)
+
+    def _scan_validation_assignments(
+        self, parsed_file: ParsedFile, jwt_config: ExtractedJwtConfig
+    ) -> None:
+        """
+        Look for TokenValidationParameters property assignments in method bodies.
+
+        Example patterns we detect:
+            ValidateIssuerSigningKey = true
+            ValidateLifetime = false
+            ValidAlgorithms = new[] { SecurityAlgorithms.HmacSha256 }
+        """
+        _bool_assign_re = re.compile(
+            r"(Validate(?:IssuerSigningKey|Lifetime|Issuer|Audience|Actor))\s*=\s*(true|false)",
+            re.IGNORECASE,
+        )
+        _algo_assign_re = re.compile(
+            r"ValidAlgorithms\s*=\s*new[^{]*\{([^}]+)\}",
+            re.IGNORECASE,
+        )
+
+        for cls in parsed_file.classes:
+            for method in cls.methods:
+                body = getattr(method, "body_source", None) or ""
+                if not body:
+                    continue
+
+                for match in _bool_assign_re.finditer(body):
+                    prop = match.group(1).lower()
+                    val = match.group(2).lower() == "true"
+                    if "issuerSigningKey" in prop or "issuersigningkey" in prop.lower():
+                        if val:
+                            jwt_config.validates_signature = True
+                    elif "lifetime" in prop:
+                        if val:
+                            jwt_config.validates_expiry = True
+                        else:
+                            jwt_config.validates_expiry = False
+                    elif "issuer" in prop:
+                        if val:
+                            jwt_config.validates_issuer = True
+                    elif "audience" in prop:
+                        if val:
+                            jwt_config.validates_audience = True
+
+                m2 = _algo_assign_re.search(body)
+                if m2:
+                    for token in re.split(r'[\s,."]+', m2.group(1)):
+                        algo = _normalize_algorithm(token)
+                        if algo:
+                            _add_algorithm(algo, jwt_config)
+
+    # Brace-balanced extraction of the lambda body for AddJwtBearer(config => { ... }).
+    _SYMMETRIC_KEY_RE = re.compile(r"new\s+SymmetricSecurityKey\s*\(\s*([A-Za-z_][\w\.]*)\s*\)")
+    _BOOL_PROP_RE = re.compile(
+        r"(Validate(?:IssuerSigningKey|Lifetime|Issuer|Audience|Actor))\s*=\s*(true|false)",
+        re.IGNORECASE,
+    )
+
+    def _scan_addjwtbearer_lambda_bodies(
+        self, parsed_file: ParsedFile, jwt_config: ExtractedJwtConfig
+    ) -> None:
+        """
+        Find every `AddJwtBearer(config => { ... })` call and parse the lambda
+        body for validation flags and signing-key references.
+
+        Minimal-hosting Program.cs has the JWT config at module scope —
+        outside any class — so the in-method body scan in
+        _scan_validation_assignments misses it entirely.  We read the file
+        from disk, walk forward from the call's line, and brace-match to
+        extract the lambda body.
+        """
+        # Only fire when we have AddJwtBearer call sites
+        jwt_calls = [
+            c for c in parsed_file.call_sites if c.callee_name.rsplit(".", 1)[-1] == "AddJwtBearer"
+        ]
+        if not jwt_calls:
+            return
+
+        try:
+            source = Path(parsed_file.path).read_text(encoding="utf-8", errors="ignore")
+        except OSError:
+            return
+
+        for call in jwt_calls:
+            body = self._extract_lambda_body(source, call.location.line)
+            if not body:
+                continue
+
+            # Boolean validation flags inside TokenValidationParameters initializer.
+            for m in self._BOOL_PROP_RE.finditer(body):
+                prop = m.group(1).lower()
+                val = m.group(2).lower() == "true"
+                if "issuersigningkey" in prop:
+                    if val:
+                        jwt_config.validates_signature = True
+                elif "lifetime" in prop:
+                    jwt_config.validates_expiry = val
+                elif "issuer" in prop:
+                    jwt_config.validates_issuer = val
+                elif "audience" in prop:
+                    jwt_config.validates_audience = val
+
+            # IssuerSigningKey = new SymmetricSecurityKey(key) — capture the
+            # referenced variable name so downstream tooling can trace it back
+            # to its declaration (often `var key = Encoding.ASCII.GetBytes(...)`).
+            if jwt_config.secret_source is None:
+                m = self._SYMMETRIC_KEY_RE.search(body)
+                if m:
+                    jwt_config.secret_source = "code"
+                    jwt_config.secret_name = m.group(1)
+
+    @staticmethod
+    def _extract_lambda_body(source: str, start_line: int) -> str:
+        """
+        Return the lambda body of an `AddJwtBearer(config => { ... })` call
+        located at-or-after `start_line` (1-indexed).
+
+        The parser records the line of the *first* statement in a chained
+        invocation (`builder.Services.AddAuthentication(...).AddJwtBearer(...)`
+        gets line=55, the AddAuthentication line, not the AddJwtBearer line).
+        We compensate by locating the literal `AddJwtBearer` token in the
+        forward chunk first, then brace-matching from there.
+        """
+        lines = source.splitlines()
+        if start_line < 1 or start_line > len(lines):
+            return ""
+        chunk = "\n".join(lines[start_line - 1 : start_line - 1 + 200])
+        marker = chunk.find("AddJwtBearer")
+        if marker == -1:
+            return ""
+        # Find the opening brace of the lambda body that follows.
+        brace = chunk.find("{", marker)
+        if brace == -1:
+            return ""
+        depth = 0
+        for i, ch in enumerate(chunk[brace:], start=brace):
+            if ch == "{":
+                depth += 1
+            elif ch == "}":
+                depth -= 1
+                if depth == 0:
+                    return chunk[brace : i + 1]
+        return ""