apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/java/jwt_config_extractor.py

@@ -0,0 +1,361 @@
+"""
+Shared JWT configuration extractor for JVM-based framework plugins.
+
+Used by SpringBootPlugin and MicronautPlugin. The design is intentionally
+self-contained so that a parallel DotNetJwtConfigExtractor can follow the
+same structure for ASP.NET Core.
+
+Detection strategy
+------------------
+1. Library — identified from import prefixes.
+2. Algorithms — extracted from signWith() / Algorithm.HMAC256() call arguments
+   and enum member references (SignatureAlgorithm.HS256).
+3. Validation flags (signature, expiry, issuer, audience) — inferred from
+   builder-chain method names and Spring Security defaults.
+4. Secret source — "env" from System.getenv(), "config" from @Value("${...}")
+   on fields, "hardcoded" from literal strings passed to signing methods.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from ...parsing.base import ParsedDecorator, ParsedFile
+from .._jwt_common import add_algorithm as _add_algorithm
+from .._jwt_common import normalize_algorithm as _normalize_alg
+from ..base import ExtractedJwtConfig
+
+# ---------------------------------------------------------------------------
+# Library detection
+# ---------------------------------------------------------------------------
+
+# Import module prefix → canonical library name surfaced in the manifest
+_JWT_IMPORT_PREFIXES: dict[str, str] = {
+    "io.jsonwebtoken": "jjwt",
+    "com.nimbusds.jwt": "nimbus-jose-jwt",
+    "com.nimbusds.jose": "nimbus-jose-jwt",
+    "org.springframework.security.oauth2.jwt": "spring-security-oauth2",
+    "com.auth0.jwt": "auth0-java-jwt",
+    "org.jose4j": "jose4j",
+    "io.micronaut.security.token.jwt": "micronaut-security-jwt",
+}
+
+# Individual class names (may arrive via wildcard imports or direct imports)
+_JWT_CLASS_NAMES: frozenset[str] = frozenset(
+    {
+        "JwtDecoder",
+        "JwtEncoder",
+        "NimbusJwtDecoder",
+        "NimbusJwtEncoder",
+        "JwtParser",
+        "JwtParserBuilder",
+        "JwtBuilder",  # jjwt
+        "SignedJWT",
+        "JWTClaimsSet",  # Nimbus
+        "DecodedJWT",
+        "JWTVerifier",  # Auth0
+    }
+)
+
+# ---------------------------------------------------------------------------
+# Algorithm normalization
+# ---------------------------------------------------------------------------
+
+# Java-library-specific algorithm name aliases → JWA canonical name.
+# The canonical JWA set lives in `frameworks/_jwt_common.py`.
+_ALGORITHM_ALIASES: dict[str, str] = {
+    # jjwt SignatureAlgorithm / MacAlgorithm enum values
+    "HMACSHA256": "HS256",
+    "HMACSHA384": "HS384",
+    "HMACSHA512": "HS512",
+    # Auth0 Java JWT
+    "HMAC256": "HS256",
+    "HMAC384": "HS384",
+    "HMAC512": "HS512",
+    "RSA256": "RS256",
+    "RSA384": "RS384",
+    "RSA512": "RS512",
+    "ECDSA256": "ES256",
+    "ECDSA384": "ES384",
+    "ECDSA512": "ES512",
+}
+
+# ---------------------------------------------------------------------------
+# Call site keyword sets
+# ---------------------------------------------------------------------------
+
+_PARSE_KEYWORDS = frozenset(
+    {
+        "parsesignedclaims",
+        "parseclaimsjws",
+        "parsejwt",
+        "parsewithhint",
+        "decode",
+        "verify",
+        "validate",
+        "parsejwsstring",
+    }
+)
+
+_SIGN_KEYWORDS = frozenset({"signwith", "withalgorithm", "algorithm"})
+
+_EXPIRY_KEYWORDS = frozenset(
+    {
+        "requireexpirationtime",
+        "acceptleeway",
+        "timestampvalidator",
+        "expiresat",
+        "setexpiration",
+        "clockskew",
+    }
+)
+
+_ISSUER_KEYWORDS = frozenset(
+    {
+        "requireissuer",
+        "setissuer",
+        "withissuer",
+        "issuer",
+        "validateissuer",
+    }
+)
+
+_AUDIENCE_KEYWORDS = frozenset(
+    {
+        "requireaudience",
+        "setaudience",
+        "withaudience",
+        "audience",
+        "validateaudience",
+    }
+)
+
+# ---------------------------------------------------------------------------
+# Secret detection
+# ---------------------------------------------------------------------------
+
+_SECRET_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "jwt",
+        "secret",
+        "signing",
+        "signkey",
+        "token",
+        "key",
+    }
+)
+
+_VALUE_RE = re.compile(r"[$#]\{([^}]+)\}")
+
+
+def _normalize_algorithm(raw: str) -> str | None:
+    """Return JWA algorithm name or None if unrecognised."""
+    return _normalize_alg(raw, _ALGORITHM_ALIASES)
+
+
+def _value_dec_raw(dec: ParsedDecorator) -> str | None:
+    """Extract the raw annotation string from an @Value decorator."""
+    if dec.positional_args:
+        return str(dec.positional_args[0])
+    val = dec.arguments.get("value")
+    return str(val) if val else None
+
+
+# ---------------------------------------------------------------------------
+# Main extractor
+# ---------------------------------------------------------------------------
+
+
+class JavaJwtConfigExtractor:
+    """
+    Extracts JWT configuration from a single parsed JVM file.
+
+    Framework plugins instantiate this once and call ``extract(parsed_file)``.
+    Subclass and override ``EXTRA_IMPORT_PREFIXES`` to add framework-specific
+    library prefixes without duplicating the core logic.
+
+    .NET equivalent: ``DotNetJwtConfigExtractor`` (same structure, different
+    library names and attribute syntax).
+    """
+
+    # Framework-specific additions (override in subclasses if needed)
+    EXTRA_IMPORT_PREFIXES: dict[str, str] = {}
+
+    def extract(self, parsed_file: ParsedFile) -> ExtractedJwtConfig | None:  # noqa: C901
+        jwt_config = ExtractedJwtConfig(library="", detected=False)
+
+        # ── 1. Library detection ──────────────────────────────────────────────
+        all_prefixes = {**_JWT_IMPORT_PREFIXES, **self.EXTRA_IMPORT_PREFIXES}
+
+        for imp in parsed_file.imports:
+            module = imp.module or ""
+            for prefix, lib_name in all_prefixes.items():
+                if module.startswith(prefix):
+                    jwt_config.detected = True
+                    jwt_config.library = jwt_config.library or lib_name
+                    break
+
+            # Also detect well-known JWT class names imported individually
+            for name in imp.names:
+                if name in _JWT_CLASS_NAMES and not jwt_config.detected:
+                    jwt_config.detected = True
+                    jwt_config.library = jwt_config.library or "spring-security-oauth2"
+
+        if not jwt_config.detected:
+            return None
+
+        # Spring Security and Micronaut Security validate signature + expiry
+        # by default when a JwtDecoder / JwtValidator bean is configured.
+        if any(kw in jwt_config.library for kw in ("spring-security", "micronaut-security")):
+            jwt_config.validates_signature = True
+            jwt_config.validates_expiry = True
+
+        # ── 2. Call site analysis ─────────────────────────────────────────────
+        for call in parsed_file.call_sites:
+            callee = call.callee_name.lower()
+
+            # Parse / decode / verify → JWT is being consumed here
+            if any(kw in callee for kw in _PARSE_KEYWORDS):
+                jwt_config.locations.append(call.location)
+                jwt_config.validates_signature = True
+
+            # Algorithm detection
+            if any(kw in callee for kw in _SIGN_KEYWORDS):
+                for arg in call.arguments:
+                    self._collect_algorithm_from_arg(arg, jwt_config)
+
+            # Also detect Algorithm.HMAC256(...) / Algorithm.RSA256(...) as the
+            # direct callee when the signing call itself IS the algorithm factory
+            # e.g.  JWT.require(Algorithm.HMAC256("secret"))
+            algo_from_callee = _normalize_algorithm(call.callee_name.split(".")[-1])
+            if algo_from_callee:
+                _add_algorithm(algo_from_callee, jwt_config)
+
+            # Validation flags
+            if any(kw in callee for kw in _EXPIRY_KEYWORDS):
+                jwt_config.validates_expiry = True
+            if any(kw in callee for kw in _ISSUER_KEYWORDS):
+                jwt_config.validates_issuer = True
+            if any(kw in callee for kw in _AUDIENCE_KEYWORDS):
+                jwt_config.validates_audience = True
+
+            # Secret source: System.getenv("JWT_SECRET")
+            if "getenv" in callee and jwt_config.secret_source is None:
+                for arg in call.arguments:
+                    if arg.is_literal and isinstance(arg.literal_value, str):
+                        val = arg.literal_value
+                        if any(kw in val.lower() for kw in _SECRET_KEYWORDS):
+                            jwt_config.secret_source = "env"
+                            jwt_config.secret_name = val
+
+            # Secret source: hardcoded string in signWith(Keys.hmacShaKeyFor(secret.getBytes()))
+            # where secret itself is a literal — detect via signWith + literal in args
+            if "signwith" in callee and jwt_config.secret_source is None:
+                for arg in call.arguments:
+                    if arg.is_literal and isinstance(arg.literal_value, str):
+                        # A literal key string passed directly is hardcoded
+                        if len(arg.literal_value) >= 8:  # skip empty/trivial
+                            jwt_config.secret_source = "hardcoded"
+
+        # ── 3. @Value field annotations → config secret ───────────────────────
+        if jwt_config.secret_source is None:
+            self._scan_value_annotations(parsed_file, jwt_config)
+
+        # ── 4. Field initializer expressions (System.getenv in field init) ────
+        if jwt_config.secret_source is None:
+            self._scan_field_initializers(parsed_file, jwt_config)
+
+        return jwt_config
+
+    def _collect_algorithm_from_arg(self, arg: Any, jwt_config: ExtractedJwtConfig) -> None:
+        """Try to extract a JWA algorithm name from a single call argument.
+
+        Handles all four storage forms produced by the Java parser:
+        - ``variable_name``  — ``SignatureAlgorithm.HS256`` → stored as
+          ``is_variable=True, variable_name="HS256"`` (qualifier lost)
+        - ``called_function`` — ``Algorithm.HMAC256("secret")`` passed as an
+          argument → ``is_call_result=True, called_function="HMAC256"``
+        - ``expression_text`` — fallback raw text from the AST
+        - ``literal_value``  — bare string literals like ``"HS256"``
+        """
+        # MemberReference: SignatureAlgorithm.HS256 → variable_name="HS256"
+        var = getattr(arg, "variable_name", None)
+        if var:
+            normalized = _normalize_algorithm(var)
+            if normalized:
+                _add_algorithm(normalized, jwt_config)
+                return
+
+        # MethodInvocation as argument: Algorithm.HMAC256("secret") →
+        # called_function="HMAC256"
+        called = getattr(arg, "called_function", None)
+        if called:
+            normalized = _normalize_algorithm(called.split(".")[-1])
+            if normalized:
+                _add_algorithm(normalized, jwt_config)
+                return
+
+        # Expression text fallback (may contain the full "SignatureAlgorithm.HS256")
+        expr = getattr(arg, "expression_text", None)
+        if expr:
+            for token in re.split(r"[.\s,()\[\]]+", expr):
+                normalized = _normalize_algorithm(token)
+                if normalized:
+                    _add_algorithm(normalized, jwt_config)
+                    return
+
+        # Bare literal string, e.g. "HS256"
+        if getattr(arg, "is_literal", False):
+            val = getattr(arg, "literal_value", None)
+            if isinstance(val, str):
+                normalized = _normalize_algorithm(val)
+                if normalized:
+                    _add_algorithm(normalized, jwt_config)
+
+    def _scan_field_initializers(
+        self,
+        parsed_file: ParsedFile,
+        jwt_config: ExtractedJwtConfig,
+    ) -> None:
+        """Detect System.getenv("JWT_SECRET") stored in field initializers.
+
+        ``String secret = System.getenv("JWT_SECRET")`` is a field declaration,
+        not a statement, so it doesn't appear in ``call_sites``.  We scan field
+        ``default_value`` strings directly using a regex.
+        """
+        _getenv_re = re.compile(r'getenv\s*\(\s*["\']([^"\']+)["\']\s*\)')
+        for cls in parsed_file.classes:
+            for f in cls.fields:
+                dv = getattr(f, "default_value", None)
+                if not dv:
+                    continue
+                m = _getenv_re.search(dv)
+                if m:
+                    val = m.group(1)
+                    if any(kw in val.lower() for kw in _SECRET_KEYWORDS):
+                        jwt_config.secret_source = "env"
+                        jwt_config.secret_name = val
+                        return
+
+    def _scan_value_annotations(
+        self,
+        parsed_file: ParsedFile,
+        jwt_config: ExtractedJwtConfig,
+    ) -> None:
+        """Detect @Value("${jwt.secret}") on class fields → secret_source="config"."""
+        for cls in parsed_file.classes:
+            for f in cls.fields:
+                for dec in getattr(f, "decorators", None) or []:
+                    if dec.name != "Value":
+                        continue
+                    raw = _value_dec_raw(dec)
+                    if not raw:
+                        continue
+                    m = _VALUE_RE.search(raw)
+                    if m:
+                        key = m.group(1)
+                        if any(kw in key.lower() for kw in _SECRET_KEYWORDS):
+                            jwt_config.secret_source = "config"
+                            jwt_config.secret_name = key
+                            return  # first match wins