mcp-server-semgrep/semgrep-rules/go/jwt-go/security/audit/jwt-parse-unverified.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: jwt-go-parse-unverified
  message: >-
    Detected the decoding of a JWT token without a verify step.
    Don't use `ParseUnverified` unless you know what you're doing
    This method parses the token but doesn't validate the signature. It's only ever useful in cases where
    you know the signature is valid (because it has been checked previously in the stack) and you want
    to extract values from it.
  metadata:
    cwe:
    - 'CWE-345: Insufficient Verification of Data Authenticity'
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    category: security
    technology:
    - jwt
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-inside: |
      import "github.com/dgrijalva/jwt-go"
      ...
  - pattern: |
      $JWT.ParseUnverified(...)