add test file for CWE-347

Add a test file for CWE-347.
The HS256 algorithm is safe, but the none algorithm is unsafe.

Author: toufik-airane

javascript/ql/src/experimental/Security/CWE-347/examples/index.js

@@ -0,0 +1,11 @@
+const jwt = require("jsonwebtoken");
+
+const secret = "buybtc";
+
+var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: "HS256" }) // alg:HS256
+jwt.verify(token, secret, { algorithms: ["HS256", "none"] }) // pass
+
+var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: "none" }) // alg:none (unsafe)
+jwt.verify(token, "", { algorithms: ["HS256", "none"] }) // detected
+jwt.verify(token, undefined, { algorithms: ["HS256", "none"] }) // detected
+jwt.verify(token, false, { algorithms: ["HS256", "none"] }) // detected