mcp-server-semgrep/semgrep-rules/javascript/jwt-simple/security/jwt-simple-noverify.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: jwt-simple-noverify
  message: >-
    Detected the decoding of a JWT token without a verify step.
    JWT tokens must be verified before use, otherwise the token's
    integrity is unknown. This means a malicious actor could forge
    a JWT token with any claims. Set 'verify' to `true` before using the token.
  severity: ERROR
  metadata:
    owasp:
    - A05:2021 - Security Misconfiguration
    - A07:2021 - Identification and Authentication Failures
    cwe:
    - 'CWE-287: Improper Authentication'
    - 'CWE-345: Insufficient Verification of Data Authenticity'
    - 'CWE-347: Improper Verification of Cryptographic Signature'
    category: security
    subcategory:
    - vuln
    technology:
    - jwt-simple
    - jwt
    confidence: HIGH
    likelihood: MEDIUM
    impact: HIGH
    references:
    - https://www.npmjs.com/package/jwt-simple
    - https://cwe.mitre.org/data/definitions/287
    - https://cwe.mitre.org/data/definitions/345
    - https://cwe.mitre.org/data/definitions/347
  languages:
  - javascript
  - typescript
  patterns:
  - pattern-inside: |
      $JWT = require('jwt-simple');
      ...
  - pattern: $JWT.decode($TOKEN, $SECRET, $NOVERIFY, ...)
  - metavariable-pattern:
      metavariable: $NOVERIFY
      patterns:
      - pattern-either:
        - pattern: |
            true
        - pattern: |
            "..."