ecdsa-scan 0.1.0

package/src/rules/_shared.js

@@ -0,0 +1,113 @@
+// Vocabulary shared by several rules: language groups, library markers and a
+// few helpers for looking at imports and call arguments.
+
+export const JS_LANGS = ["js", "ts"];
+export const CODE_LANGS = ["js", "ts", "python", "go"];
+
+/** Words that mean "this file is doing cryptography", used to gate noisy rules. */
+export const CRYPTO_CONTEXT_RE =
+  /\b(sign|signing|signature|signer|verify|verification|privateKey|private_key|secret|seed|nonce|entropy|keypair|key_pair|hmac|digest|ecdsa|secp256|p-?256|ed25519|rsa|jwt|jws|token|cipher|encrypt|decrypt|salt|mnemonic)\b/i;
+
+/** Markers of the secp256k1 (blockchain) world. */
+export const K1_RE = /\b(secp256k1|k256|ES256K|SECP256K1|Secp256k1)\b/;
+
+/** Markers of the NIST P-256 world. */
+export const P256_RE = /\b(p256|P-256|P256|prime256v1|secp256r1|SECP256R1|ES256(?!K))\b/;
+
+/** Ethereum / Bitcoin markers. */
+export const CHAIN_RE =
+  /\b(ethers|web3|viem|ethereum|eth_(?:sign|sendTransaction|accounts)|keccak256|personal_sign|bitcoin|bitcoinjs|bip32|bip39|wallet|EIP-?191|EIP-?712|0x[a-fA-F0-9]{40}\b)/;
+
+const JS = ["js", "ts"];
+const PY = ["python"];
+const GO = ["go"];
+
+/**
+ * Known crypto libraries for the inventory rule. `langs` keeps a JavaScript
+ * `import jwt from "jsonwebtoken"` from being reported as Python's PyJWT.
+ */
+export const LIBRARY_MARKERS = [
+  { name: "jsonwebtoken", re: /['"]jsonwebtoken['"]/, ecosystem: "npm", langs: JS },
+  { name: "jose", re: /['"]jose['"]/, ecosystem: "npm", langs: JS },
+  { name: "jwt-decode", re: /['"]jwt-decode['"]/, ecosystem: "npm", langs: JS },
+  { name: "@noble/curves", re: /['"]@noble\/curves[^'"]*['"]/, ecosystem: "npm", langs: JS },
+  { name: "@noble/hashes", re: /['"]@noble\/hashes[^'"]*['"]/, ecosystem: "npm", langs: JS },
+  { name: "@noble/secp256k1", re: /['"]@noble\/secp256k1['"]/, ecosystem: "npm", langs: JS },
+  { name: "elliptic", re: /['"]elliptic['"]/, ecosystem: "npm", langs: JS },
+  { name: "secp256k1", re: /['"]secp256k1['"]/, ecosystem: "npm", langs: JS },
+  { name: "ethers", re: /['"]ethers(?:\/[^'"]*)?['"]/, ecosystem: "npm", langs: JS },
+  { name: "viem", re: /['"]viem(?:\/[^'"]*)?['"]/, ecosystem: "npm", langs: JS },
+  { name: "web3", re: /['"]web3(?:\/[^'"]*)?['"]/, ecosystem: "npm", langs: JS },
+  { name: "bitcoinjs-lib", re: /['"]bitcoinjs-lib['"]/, ecosystem: "npm", langs: JS },
+  { name: "tweetnacl", re: /['"]tweetnacl['"]/, ecosystem: "npm", langs: JS },
+  { name: "node-forge", re: /['"]node-forge['"]/, ecosystem: "npm", langs: JS },
+  { name: "@peculiar/x509", re: /['"]@peculiar\/x509['"]/, ecosystem: "npm", langs: JS },
+  { name: "node:crypto", re: /['"](?:node:)?crypto['"]/, ecosystem: "node", langs: JS },
+  { name: "WebCrypto (SubtleCrypto)", re: /\bcrypto\.subtle\./, ecosystem: "web", langs: JS },
+  { name: "PyJWT", re: /^\s*(?:import\s+jwt\b|from\s+jwt\s+import)/m, ecosystem: "pypi", langs: PY },
+  { name: "cryptography", re: /\bfrom\s+cryptography[.\s]/, ecosystem: "pypi", langs: PY },
+  { name: "pycryptodome", re: /\bfrom\s+Crypto[.\s]/, ecosystem: "pypi", langs: PY },
+  { name: "ecdsa (python)", re: /^\s*(?:import\s+ecdsa\b|from\s+ecdsa\s+import)/m, ecosystem: "pypi", langs: PY },
+  { name: "requests", re: /^\s*(?:import\s+requests\b|from\s+requests\s+import)/m, ecosystem: "pypi", langs: PY },
+  { name: "crypto/ecdsa", re: /["']crypto\/ecdsa["']/, ecosystem: "go", langs: GO },
+  { name: "crypto/elliptic", re: /["']crypto\/elliptic["']/, ecosystem: "go", langs: GO },
+  { name: "crypto/tls", re: /["']crypto\/tls["']/, ecosystem: "go", langs: GO },
+  { name: "crypto/rsa", re: /["']crypto\/rsa["']/, ecosystem: "go", langs: GO },
+  { name: "golang-jwt", re: /["']github\.com\/golang-jwt\/jwt[^"']*["']/, ecosystem: "go", langs: GO },
+  { name: "btcec", re: /["'][^"']*btcec[^"']*["']/, ecosystem: "go", langs: GO },
+];
+
+/** Algorithms and curves worth listing in the inventory / future CBOM. */
+export const ALGORITHM_MARKERS = [
+  { name: "ES256", re: /\bES256\b(?!K)/, kind: "algorithm" },
+  { name: "ES256K", re: /\bES256K\b/, kind: "algorithm" },
+  { name: "ES384", re: /\bES384\b/, kind: "algorithm" },
+  { name: "ES512", re: /\bES512\b/, kind: "algorithm" },
+  { name: "EdDSA", re: /\b(?:EdDSA|Ed25519|ed25519)\b/, kind: "algorithm" },
+  { name: "RS256", re: /\bRS256\b/, kind: "algorithm" },
+  { name: "PS256", re: /\bPS256\b/, kind: "algorithm" },
+  { name: "HS256", re: /\bHS(?:256|384|512)\b/, kind: "algorithm" },
+  { name: "RSA-PSS", re: /\b(?:RSA-PSS|rsa_pss|PSS\()/, kind: "algorithm" },
+  { name: "ECDSA", re: /\b(?:ecdsa|ECDSA)\b/, kind: "algorithm" },
+  { name: "SHA-1", re: /\b(?:sha1|SHA1|SHA-1)\b/, kind: "algorithm" },
+  { name: "MD5", re: /\b(?:md5|MD5)\b/, kind: "algorithm" },
+  { name: "SHA-256", re: /\b(?:sha256|SHA256|SHA-256)\b/, kind: "algorithm" },
+  { name: "SHA-384", re: /\b(?:sha384|SHA384|SHA-384)\b/, kind: "algorithm" },
+  { name: "SHA-512", re: /\b(?:sha512|SHA512|SHA-512)\b/, kind: "algorithm" },
+  { name: "secp256k1", re: K1_RE, kind: "curve" },
+  { name: "P-256", re: /\b(?:p256|P-256|P256|prime256v1|secp256r1|SECP256R1)\b/, kind: "curve" },
+  { name: "P-384", re: /\b(?:p384|P-384|P384|secp384r1|SECP384R1)\b/, kind: "curve" },
+  { name: "P-521", re: /\b(?:p521|P-521|P521|secp521r1|SECP521R1)\b/, kind: "curve" },
+  { name: "Curve25519", re: /\b(?:x25519|X25519|curve25519)\b/, kind: "curve" },
+];
+
+/** True when the JS/TS file imports `name` from a module matching `moduleRe`. */
+export function jsImportsBinding(ctx, moduleSource, name) {
+  const escaped = moduleSource.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+  const patterns = [
+    new RegExp(`import\\s*\\{([^}]*)\\}\\s*from\\s*['"]${escaped}['"]`),
+    new RegExp(`(?:const|let|var)\\s*\\{([^}]*)\\}\\s*=\\s*require\\(\\s*['"]${escaped}['"]`),
+  ];
+  for (const re of patterns) {
+    const m = ctx.code.match(re);
+    if (m && new RegExp(`\\b${name}\\b`).test(m[1])) return true;
+  }
+  return false;
+}
+
+/** True when a Python file imports `name` (`from mod import name` / `import mod`). */
+export function pyImports(ctx, moduleName) {
+  const escaped = moduleName.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+  return new RegExp(`^\\s*(?:import\\s+${escaped}\\b|from\\s+${escaped}[.\\s])`, "m").test(ctx.code);
+}
+
+/** True when the argument text of a call sets `key` (`key:`, `key=` or `"key":`). */
+export function argsHaveOption(args, key) {
+  return new RegExp(`(?:^|[\\s,{(])["']?${key}["']?\\s*[:=]`).test(args);
+}
+
+/** Strip a call's argument text down to one line for a readable message. */
+export function condense(text, maxLen = 90) {
+  const flat = text.replace(/\s+/g, " ").trim();
+  return flat.length > maxLen ? `${flat.slice(0, maxLen - 1)}…` : flat;
+}

package/src/rules/crypto-inventory.js

@@ -0,0 +1,35 @@
+// Inventory collector (not a defect rule): which crypto libraries, algorithms
+// and curves each file touches. This is the seed of the CBOM — a cryptographic
+// bill of materials — that the hosted product builds on.
+
+import { ALGORITHM_MARKERS, CODE_LANGS, LIBRARY_MARKERS } from "./_shared.js";
+
+const OPERATIONS = [
+  { name: "sign", re: /\b(?:createSign|\.sign\s*\(|signSync|SignASN1|sign_digest|sign\s*\(data|Sign\s*\()/ },
+  { name: "verify", re: /\b(?:createVerify|\.verify\s*\(|verifySync|VerifyASN1|verify_digest|Verify\s*\()/ },
+  { name: "keygen", re: /\b(?:generateKeyPair(?:Sync)?|GenerateKey|generate_private_key|randomPrivateKey|keygen)\b/ },
+  { name: "kms", re: /\b(?:KMSClient|kms\.sign|SignCommand|CloudKMS|KeyVault|Vault(?:Client)?|hsm|HSM|pkcs11)\b/ },
+];
+
+export default {
+  id: "crypto-inventory",
+  title: "Cryptographic inventory",
+  kind: "inventory",
+  languages: CODE_LANGS,
+  why: "Not a defect: the libraries, algorithms, curves and signing operations found in the scanned tree.",
+
+  collect(ctx) {
+    const items = [];
+    for (const lib of LIBRARY_MARKERS) {
+      if (lib.langs && !lib.langs.includes(ctx.lang)) continue;
+      if (lib.re.test(ctx.code)) items.push({ kind: "library", name: lib.name, detail: lib.ecosystem });
+    }
+    for (const alg of ALGORITHM_MARKERS) {
+      if (alg.re.test(ctx.code)) items.push({ kind: alg.kind, name: alg.name });
+    }
+    for (const op of OPERATIONS) {
+      if (op.re.test(ctx.code)) items.push({ kind: "operation", name: op.name });
+    }
+    return items;
+  },
+};

package/src/rules/curve-mixing.js

@@ -0,0 +1,71 @@
+// Rule: secp256k1 and P-256 handled in the same module, or a P-256 key created
+// in blockchain code.
+
+import { CHAIN_RE, CODE_LANGS, K1_RE, P256_RE, condense } from "./_shared.js";
+
+const SIGNING_OP = /\b(sign|verify|generateKey|generateKeyPair|GenerateKey|getPublicKey|keyFrom|from_private|from_public|randomPrivateKey)/;
+
+/** Ways of creating a P-256 key across the supported languages. */
+const P256_KEYGEN = [
+  /namedCurve\s*:\s*["'](?:P-256|prime256v1|secp256r1)["']/,
+  /generateKeyPair(?:Sync)?\s*\(\s*["']ec["'][^)]{0,120}?(?:P-256|prime256v1|secp256r1)/,
+  /\bp256\s*\.\s*(?:utils\s*\.\s*randomPrivateKey|keygen|getPublicKey)\s*\(/,
+  /\bnew\s+(?:EC|ec)\s*\(\s*["'](?:p256|prime256v1|secp256r1)["']\s*\)/,
+  /ec\s*\.\s*generate_private_key\s*\(\s*ec\s*\.\s*SECP256R1/,
+  /ecdsa\.GenerateKey\s*\(\s*elliptic\.P256\s*\(\s*\)/,
+  /\bSECP256r1\b|\bNIST256p\b/,
+];
+
+export default {
+  id: "curve-mixing",
+  title: "secp256k1 and P-256 used together, or P-256 used in blockchain code",
+  severity: "medium",
+  confidence: "advisory",
+  languages: CODE_LANGS,
+  why:
+    "secp256k1 (Bitcoin/Ethereum) and P-256 alias secp256r1 (TLS, JWT ES256, passkeys) are different curves with almost identical names, and libraries rarely stop you from feeding a key of one curve into an operation for the other. " +
+    "The symptoms are confusing: signatures that never verify, addresses that do not match, or — worse — a key silently interpreted on the wrong curve. " +
+    "Keep each curve in its own module, or name variables so the curve is unmistakable.",
+  fix: [
+    "// name the curve at every boundary",
+    "import { secp256k1 } from '@noble/curves/secp256k1.js';  // chain keys",
+    "import { p256 } from '@noble/curves/nist.js';            // ES256 / passkeys",
+    "const chainKey = secp256k1.getPublicKey(chainPriv);",
+    "const es256Key = p256.getPublicKey(es256Priv);",
+  ].join("\n"),
+  docs: "https://www.rfc-editor.org/rfc/rfc7518#section-3.4",
+
+  match(ctx) {
+    const out = [];
+
+    // (a) A P-256 key created in a file that also talks to a blockchain.
+    if (CHAIN_RE.test(ctx.code)) {
+      for (const re of P256_KEYGEN) {
+        for (const m of ctx.matchAll(new RegExp(re.source, "g"))) {
+          if (ctx.isMasked(m.index)) continue;
+          out.push({
+            index: m.index,
+            confidence: "suspected",
+            message: `A P-256 (secp256r1) key is created here (\`${condense(m[0], 60)}\`) while this file also works with Ethereum/Bitcoin, which use secp256k1. Chain keys and addresses derived from a P-256 key will not match.`,
+          });
+        }
+      }
+    }
+
+    // (b) Both curves in one module. Only identifiers and imports count here:
+    // curve names inside strings, types and prose (converter drop-downs,
+    // documentation, marketing copy) are matched but not reported.
+    const k1 = ctx.structure.match(new RegExp(K1_RE.source));
+    const p256 = ctx.structure.match(new RegExp(P256_RE.source));
+    if (k1 && p256 && SIGNING_OP.test(ctx.structure) && out.length === 0) {
+      const index = Math.min(k1.index, p256.index);
+      out.push({
+        index,
+        confidence: "advisory",
+        message: `This module references both secp256k1 (\`${k1[0]}\`) and P-256 (\`${p256[0]}\`). Check that keys, signatures and hashes of the two curves cannot reach each other's code paths. Files that deliberately support several curves (converters, debuggers, curve tables) will match this rule legitimately.`,
+      });
+    }
+
+    return out;
+  },
+};

package/src/rules/hardcoded-private-key.js

@@ -0,0 +1,66 @@
+// Rule: private key material embedded in source code.
+
+import { CODE_LANGS } from "./_shared.js";
+
+// The header must be followed by real base64 key material. A bare
+// "-----BEGIN OPENSSH PRIVATE KEY-----" in UI copy or in a scanner pattern is
+// not a key, and reporting it would be pure noise.
+const PEM_PRIVATE = /-----BEGIN\s+(?:[A-Z0-9]+\s+)*PRIVATE KEY-----[^\S\n]*\\?[nr]?\s*\n?[\s\\n]*[A-Za-z0-9+/=]{40}/g;
+const PEM_HEADER = /-----BEGIN\s+(?:[A-Z0-9]+\s+)*PRIVATE KEY-----/;
+const HEX_ASSIGN = /([A-Za-z_$][\w$]*)\s*(?::=|=|:)\s*["'`](?:0x)?([0-9a-fA-F]{64})["'`]/g;
+
+/** Variable names that mean "this is key material". */
+const SECRET_NAME = /priv|secret|signing|sign_key|signkey|seed|mnemonic|master_?key|wif|(?:^|_|\b)sk(?:$|_|\b)/i;
+/** Names that look secret but are not (public keys, digests, addresses). */
+const NOT_SECRET_NAME = /public|pub_|_pub|address|hash|digest|checksum|txid|blockhash|commit|sha256|fingerprint|thumbprint|expected|salt$/i;
+
+export default {
+  id: "hardcoded-private-key",
+  title: "Private key material embedded in source",
+  severity: "high",
+  confidence: "confirmed",
+  languages: [...CODE_LANGS, "keyfile"],
+  why:
+    "A private key checked into a repository is compromised the moment anyone clones, forks or mirrors it, and rotating it means re-issuing every signature, certificate or account that depends on it. " +
+    "Git keeps the value in history even after the line is deleted, so removal is never enough on its own. " +
+    "Keys belong in a KMS, an HSM or (at minimum) an environment variable injected at deploy time.",
+  fix: [
+    "// read the key at run time; keep the value out of the repository",
+    "const privateKey = process.env.SIGNING_PRIVATE_KEY;",
+    "// better: never hold the key at all — sign through KMS/HSM",
+    "const signature = await kms.sign({ KeyId, Message, SigningAlgorithm: 'ECDSA_SHA_256' });",
+  ].join("\n"),
+  docs: "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html",
+
+  match(ctx) {
+    const out = [];
+    // PEM blocks are matched against the raw text on purpose: a key pasted into
+    // a comment is just as leaked as one in a string literal.
+    for (const m of ctx.text.matchAll(PEM_PRIVATE)) {
+      const header = m[0].match(PEM_HEADER)[0];
+      out.push({
+        index: m.index,
+        confidence: ctx.isTestPath ? "advisory" : "confirmed",
+        message: ctx.isTestPath
+          ? `A private key block (\`${header}\`) with real key material is embedded here. The path looks like test/fixture material, so this is probably intentional — make sure the key is disposable and never used outside tests.`
+          : `A private key block (\`${header}\`) is embedded in source. Treat this key as compromised: rotate it, then remove the value from git history.`,
+      });
+    }
+
+    if (ctx.lang === "keyfile") return out;
+
+    for (const m of ctx.matchAll(HEX_ASSIGN)) {
+      const name = m[1];
+      if (!SECRET_NAME.test(name) || NOT_SECRET_NAME.test(name)) continue;
+      out.push({
+        index: m.index,
+        confidence: ctx.isTestPath ? "advisory" : "suspected",
+        message: `\`${name}\` is assigned a 64-character hex literal — the exact shape of a secp256k1/P-256 private key or a symmetric signing key.${
+          ctx.isTestPath ? " The path looks like test material, so this may be a deliberate test vector." : " If this is a real key, rotate it and load the value from the environment or a KMS instead."
+        }`,
+      });
+    }
+
+    return out;
+  },
+};

package/src/rules/index.js

@@ -0,0 +1,42 @@
+// The rule set. Order here is the order rules are documented in `--help` and
+// the README; findings are sorted by file/line, not by rule.
+
+import jwtVerifyMissingAlgorithms from "./jwt-verify-missing-algorithms.js";
+import jwtDecodeWithoutVerification from "./jwt-decode-without-verification.js";
+import jwtAlgFromToken from "./jwt-alg-from-token.js";
+import curveMixing from "./curve-mixing.js";
+import signatureEncoding from "./signature-encoding.js";
+import secp256k1LowS from "./secp256k1-low-s.js";
+import insecureNonceSource from "./insecure-nonce-source.js";
+import hardcodedPrivateKey from "./hardcoded-private-key.js";
+import keyFileOutsideTests from "./key-file-outside-tests.js";
+import nonConstantTimeComparison from "./non-constant-time-comparison.js";
+import uncheckedVerificationResult from "./unchecked-verification-result.js";
+import weakSignatureHash from "./weak-signature-hash.js";
+import unvalidatedPublicKeyPoint from "./unvalidated-public-key-point.js";
+import tlsVerificationDisabled from "./tls-verification-disabled.js";
+import cryptoInventory from "./crypto-inventory.js";
+
+export const rules = [
+  jwtVerifyMissingAlgorithms,
+  jwtDecodeWithoutVerification,
+  jwtAlgFromToken,
+  curveMixing,
+  signatureEncoding,
+  secp256k1LowS,
+  insecureNonceSource,
+  hardcodedPrivateKey,
+  keyFileOutsideTests,
+  nonConstantTimeComparison,
+  uncheckedVerificationResult,
+  weakSignatureHash,
+  unvalidatedPublicKeyPoint,
+  tlsVerificationDisabled,
+  cryptoInventory,
+];
+
+export const defectRules = rules.filter((rule) => rule.kind !== "inventory");
+
+export function ruleById(id) {
+  return rules.find((rule) => rule.id === id);
+}

package/src/rules/insecure-nonce-source.js

@@ -0,0 +1,80 @@
+// Rule: non-cryptographic randomness, or a caller-supplied ECDSA nonce.
+
+import { CODE_LANGS, CRYPTO_CONTEXT_RE, condense } from "./_shared.js";
+
+const WEAK_RANDOM = [
+  { re: /\bMath\s*\.\s*random\s*\(/, langs: ["js", "ts"], name: "Math.random()" },
+  { re: /\brandom\s*\.\s*(?:random|randint|randrange|choice|choices|getrandbits|sample|shuffle|uniform)\s*\(/, langs: ["python"], name: "random module" },
+  { re: /\bmath\/rand\b/, langs: ["go"], name: 'math/rand' },
+];
+
+/** Words that must appear near the call for it to be a crypto nonce/secret. */
+const SENSITIVE_NEARBY =
+  /\b(sign|signing|signature|nonce|entropy|seed|salt|iv|privateKey|private_key|priv|secret|key|keyPair|keypair|token|otp|csrf|session|password|mnemonic|challenge|apiKey|api_key)\b/i;
+
+/** Explicit nonce/k handed to a signing routine. */
+const EXPLICIT_K = [
+  { re: /\bsign\w*\s*\([^)]{0,200}?\bk\s*=\s*[^),\s]/, note: "explicit k= argument" },
+  { re: /\bextraEntropy\s*[:=]\s*(?!false\b)[^,)\s}]+/, note: "extraEntropy" },
+  { re: /\b(?:deterministic|rfc6979)\s*[:=]\s*(?:false|False|0)\b/, note: "deterministic signing disabled" },
+  { re: /\bsign\w*\s*\([^)]{0,200}?\bnonce\s*[:=]\s*[^),\s]/, note: "explicit nonce argument" },
+];
+
+export default {
+  id: "insecure-nonce-source",
+  title: "Weak randomness or a caller-supplied nonce in signing code",
+  severity: "high",
+  confidence: "confirmed",
+  languages: CODE_LANGS,
+  why:
+    "ECDSA leaks the private key if the per-signature nonce k is predictable, biased, or ever reused — two signatures sharing a k are enough to recover the key with school algebra (this is how the PS3 and several early wallets were broken). " +
+    "`Math.random()` and Python's `random` module are seeded PRNGs meant for simulations, not for key material. " +
+    "Let the library derive k deterministically (RFC 6979) or take it from the OS CSPRNG; never pass your own.",
+  fix: [
+    "// JS: crypto.getRandomValues / crypto.randomBytes, never Math.random",
+    "const bytes = crypto.getRandomValues(new Uint8Array(32));",
+    "",
+    "# Python: secrets, never random",
+    "import secrets; nonce = secrets.token_bytes(32)",
+    "",
+    "// and let the library pick k (RFC 6979 deterministic ECDSA)",
+    "const sig = secp256k1.sign(msgHash, privateKey);",
+  ].join("\n"),
+  docs: "https://www.rfc-editor.org/rfc/rfc6979",
+
+  match(ctx) {
+    const out = [];
+    const fileIsCrypto = CRYPTO_CONTEXT_RE.test(ctx.code);
+
+    if (fileIsCrypto) {
+      for (const source of WEAK_RANDOM) {
+        if (!source.langs.includes(ctx.lang)) continue;
+        if (source.name === "math/rand" && !/["']math\/rand["']/.test(ctx.code)) continue;
+        const re = source.name === "math/rand" ? /\brand\s*\.\s*(?:Int\w*|Read|Float\w*|Perm|Seed)\s*\(/g : new RegExp(source.re.source, "g");
+        for (const m of ctx.matchAll(re)) {
+          if (ctx.isMasked(m.index)) continue; // documentation, not a call
+          const around = ctx.window(m.index, 5, 5);
+          if (!SENSITIVE_NEARBY.test(around)) continue;
+          out.push({
+            index: m.index,
+            confidence: "confirmed",
+            message: `\`${condense(m[0], 40)}\` is a non-cryptographic pseudo-random generator, and it is used next to key/nonce/token material. Its output is predictable from a handful of samples.`,
+          });
+        }
+      }
+    }
+
+    for (const pattern of EXPLICIT_K) {
+      for (const m of ctx.matchAll(new RegExp(pattern.re.source, "g"))) {
+        if (ctx.isMasked(m.index)) continue;
+        out.push({
+          index: m.index,
+          confidence: "suspected",
+          message: `The signing call takes its randomness from the caller (${pattern.note}: \`${condense(m[0], 60)}\`). Supplying k yourself removes the library's RFC 6979 protection; if that value is ever repeated or biased, the private key can be recovered. Extra entropy taken from a CSPRNG on top of deterministic k is fine — verify which case this is.`,
+        });
+      }
+    }
+
+    return out;
+  },
+};

package/src/rules/jwt-alg-from-token.js

@@ -0,0 +1,53 @@
+// Rule: the algorithm used for verification is taken from the token itself.
+
+import { CODE_LANGS, condense } from "./_shared.js";
+
+// algorithms: [decoded.header.alg] / algorithm: header["alg"] / algorithms=[unverified["alg"]]
+const DOT_ALG =
+  /\balgorithms?\s*[:=]\s*\[?\s*[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\.(?:alg|algorithm)\b/;
+const INDEX_ALG =
+  /\balgorithms?\s*[:=]\s*\[?\s*[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\s*\[\s*["']alg["']\s*\]/;
+const UNVERIFIED_HEADER =
+  /\balgorithms?\s*[:=]\s*\[?[^\]\n;]{0,120}?(?:get_unverified_header|decodeProtectedHeader|decode\s*\([^)]*complete\s*:\s*true)/;
+const GO_TOKEN_METHOD =
+  /\bjwt\.GetSigningMethod\s*\(\s*[A-Za-z_][\w.]*\.Header\s*\[\s*"alg"\s*\]/;
+
+/** Receivers that clearly denote token-supplied data. */
+const TOKEN_SOURCE = /header|headers|decoded|unverified|token|payload|jose|protected|claims/i;
+
+export default {
+  id: "jwt-alg-from-token",
+  title: "Verification algorithm taken from the token header",
+  severity: "high",
+  confidence: "confirmed",
+  languages: CODE_LANGS,
+  why:
+    "Passing the token's own `alg` value into the verifier turns the allow-list into a no-op: the attacker picks the algorithm and the library obeys. " +
+    "With an RSA or EC public key this becomes the textbook HS256 confusion attack — the public key is used as an HMAC secret and a forged token verifies. " +
+    "The accepted algorithm must be a constant in your code, decided by the key you hold, never read from untrusted input.",
+  fix: [
+    "// bad",
+    "const { header } = jwt.decode(token, { complete: true });",
+    "jwt.verify(token, key, { algorithms: [header.alg] });",
+    "",
+    "// good — the key type decides the algorithm",
+    'jwt.verify(token, ecPublicKey, { algorithms: ["ES256"] });',
+  ].join("\n"),
+  docs: "https://datatracker.ietf.org/doc/html/rfc8725#section-2.1",
+
+  match(ctx) {
+    const out = [];
+    const patterns = [DOT_ALG, INDEX_ALG, UNVERIFIED_HEADER, GO_TOKEN_METHOD];
+    for (const re of patterns) {
+      for (const m of ctx.matchAll(new RegExp(re.source, "g"))) {
+        if (ctx.isMasked(m.index)) continue; // a code sample inside a string
+        if ((re === DOT_ALG || re === INDEX_ALG) && !TOKEN_SOURCE.test(m[0])) continue;
+        out.push({
+          index: m.index,
+          message: `The algorithm list is built from token-supplied data (\`${condense(m[0], 70)}\`) — an attacker chooses how their own token is verified.`,
+        });
+      }
+    }
+    return out;
+  },
+};

package/src/rules/jwt-decode-without-verification.js

@@ -0,0 +1,72 @@
+// Rule: reading JWT claims without checking the signature.
+
+import { CODE_LANGS, JS_LANGS, condense } from "./_shared.js";
+
+const JS_DECODE = /\b(?:jwt|jsonwebtoken|JWT)\s*\.\s*decode\b|\b(?:decodeJwt|jwtDecode|jwt_decode|decodeProtectedHeader)\b/;
+const PY_DECODE = /\bjwt\s*\.\s*decode\b/;
+const PY_VERIFY_OFF = /verify_signature["']?\s*[:=]\s*False|(?:^|[\s,(])verify\s*=\s*False/;
+
+/** Identifiers that suggest the decoded claims drive an access decision. */
+const DECISION_RE =
+  /\b(role|roles|isAdmin|is_admin|admin|permission|permissions|scope|scopes|userId|user_id|currentUser|req\.user|ctx\.user|tenant|account|authoriz|authorize|allow|deny|grant|session|principal|sub\b|claims\.)\b/i;
+
+export default {
+  id: "jwt-decode-without-verification",
+  title: "JWT decoded without verifying the signature",
+  severity: "high",
+  confidence: "suspected",
+  languages: CODE_LANGS,
+  why:
+    "`decode` only base64url-decodes the token: anyone can craft a JWT with any claims, and decoding it will happily return them. " +
+    "That is fine for logging or for reading `kid` before fetching a key, but if the claims then decide who the user is or what they may do, the whole authentication check is bypassed. " +
+    "The same applies to PyJWT with `verify_signature: False`.",
+  fix: [
+    '// instead of: const claims = jwt.decode(token);',
+    'const claims = jwt.verify(token, publicKey, { algorithms: ["ES256"] });',
+    '# PyJWT',
+    'claims = jwt.decode(token, key, algorithms=["ES256"])  # not options={"verify_signature": False}',
+  ].join("\n"),
+  docs: "https://datatracker.ietf.org/doc/html/rfc8725#section-3.2",
+
+  match(ctx) {
+    const out = [];
+    const calls = [];
+
+    if (JS_LANGS.includes(ctx.lang)) {
+      for (const call of ctx.findCalls(new RegExp(JS_DECODE.source, "g"))) {
+        // A `jwt.decode(` inside a documentation string is not a call.
+        if (ctx.isMasked(call.index)) continue;
+        calls.push({ ...call, kind: "js" });
+      }
+    }
+    if (ctx.lang === "python") {
+      for (const call of ctx.findCalls(new RegExp(PY_DECODE.source, "g"))) {
+        if (ctx.isMasked(call.index)) continue;
+        if (PY_VERIFY_OFF.test(call.args)) calls.push({ ...call, kind: "py-off" });
+      }
+      // `verify=False` on a bare decode helper, e.g. jwt.decode(token, verify=False)
+      for (const m of ctx.matchAll(/options\s*=\s*\{[^}]*verify_signature["']?\s*:\s*False[^}]*\}/g)) {
+        if (!calls.some((c) => Math.abs(c.index - m.index) < 200)) {
+          calls.push({ index: m.index, callee: "jwt.decode", args: m[0], kind: "py-off" });
+        }
+      }
+    }
+
+    for (const call of calls) {
+      const after = ctx.window(call.index, 1, 12);
+      const decisionNearby = DECISION_RE.test(after);
+      const message =
+        call.kind === "py-off"
+          ? `Signature verification is switched off (\`${condense(call.args, 70)}\`) — the claims are attacker-controlled.`
+          : `\`${call.callee}\` does not verify the signature; the claims it returns are attacker-controlled.`;
+      out.push({
+        index: call.index,
+        confidence: decisionNearby ? "suspected" : "advisory",
+        message: decisionNearby
+          ? `${message} Identity/authorization identifiers appear right after this call.`
+          : `${message} No authorization decision was detected nearby, so this may be a legitimate inspection (logging, reading \`kid\`) — confirm before acting.`,
+      });
+    }
+    return out;
+  },
+};

package/src/rules/jwt-verify-missing-algorithms.js

@@ -0,0 +1,99 @@
+// Rule: JWT verification without an explicit allow-list of algorithms.
+
+import { CODE_LANGS, JS_LANGS, argsHaveOption, condense, jsImportsBinding } from "./_shared.js";
+
+const JS_JWT_VERIFY = /\b(?:jwt|jsonwebtoken|jwtLib|JWT|jsonWebToken)\s*\.\s*verify\b/;
+const JOSE_VERIFY = /\b(?:jwtVerify|compactVerify|flattenedVerify|generalVerify)\b/;
+const BARE_VERIFY = /(?<![.\w$])verify\b/;
+const PY_JWT_DECODE = /\bjwt\s*\.\s*decode\b/;
+const GO_JWT_PARSE = /\bjwt\s*\.\s*(?:Parse|ParseWithClaims)\b/;
+
+const NONE_ALG = /algorithms?\s*[:=]\s*\[\s*(?:\]|["'](?:none|NONE|None)["'])/;
+const PY_VERIFY_OFF = /verify_signature["']?\s*[:=]\s*False|(?:^|[\s,(])verify\s*=\s*False/;
+
+/** Algorithm lists that are present but useless. */
+function emptyOrNone(args) {
+  return NONE_ALG.test(args);
+}
+
+export default {
+  id: "jwt-verify-missing-algorithms",
+  title: "JWT verified without an explicit algorithm allow-list",
+  severity: "high",
+  confidence: "confirmed",
+  languages: CODE_LANGS,
+  why:
+    "A JWT names its own algorithm in the header, so a verifier that does not pin the accepted algorithms lets the token choose how it is checked. " +
+    "The classic result is algorithm confusion: an attacker re-signs the token with HS256 using your RSA/EC public key as the HMAC secret, or supplies alg:none, and verification succeeds. " +
+    "Always pass the exact algorithms your issuer uses.",
+  fix: [
+    'jsonwebtoken:  jwt.verify(token, publicKey, { algorithms: ["ES256"] })',
+    'jose:          await jwtVerify(token, key, { algorithms: ["ES256"] })',
+    'PyJWT:         jwt.decode(token, key, algorithms=["ES256"])',
+    'golang-jwt:    jwt.Parse(s, keyFunc, jwt.WithValidMethods([]string{"ES256"}))',
+  ].join("\n"),
+  docs: "https://datatracker.ietf.org/doc/html/rfc8725#section-3.1",
+
+  match(ctx) {
+    const out = [];
+    if (JS_LANGS.includes(ctx.lang)) {
+      const bareVerifyIsJwt = jsImportsBinding(ctx, "jsonwebtoken", "verify");
+      const calleeRe = bareVerifyIsJwt
+        ? new RegExp(`${JS_JWT_VERIFY.source}|${JOSE_VERIFY.source}|${BARE_VERIFY.source}`, "g")
+        : new RegExp(`${JS_JWT_VERIFY.source}|${JOSE_VERIFY.source}`, "g");
+      for (const call of ctx.findCalls(calleeRe)) {
+        if (ctx.isMasked(call.index)) continue; // documentation, not a call
+        if (argsHaveOption(call.args, "algorithms")) {
+          if (!emptyOrNone(call.args)) continue;
+          out.push({
+            index: call.index,
+            message: `\`${call.callee}\` accepts an empty algorithm list or "none" — every token, including unsigned ones, will pass.`,
+          });
+          continue;
+        }
+        out.push({
+          index: call.index,
+          message: `\`${call.callee}(${condense(call.args, 60)})\` does not pass \`algorithms\`, so the token header decides how the signature is checked.`,
+        });
+      }
+    }
+
+    if (ctx.lang === "python") {
+      for (const call of ctx.findCalls(new RegExp(PY_JWT_DECODE.source, "g"))) {
+        if (ctx.isMasked(call.index)) continue;
+        if (PY_VERIFY_OFF.test(call.args)) continue; // reported by jwt-decode-without-verification
+        if (argsHaveOption(call.args, "algorithms")) {
+          if (!emptyOrNone(call.args)) continue;
+          out.push({
+            index: call.index,
+            message: 'PyJWT `jwt.decode` is given an empty `algorithms` list or "none" — the signature check becomes meaningless.',
+          });
+          continue;
+        }
+        out.push({
+          index: call.index,
+          message: `PyJWT \`jwt.decode(${condense(call.args, 60)})\` has no \`algorithms=[...]\` argument, so the accepted algorithm is not pinned.`,
+        });
+      }
+    }
+
+    if (ctx.lang === "go") {
+      // golang-jwt checks the algorithm only if the key function inspects
+      // token.Method or the parser is given WithValidMethods. If neither the
+      // call nor the rest of the file mentions them, nothing pins the alg.
+      const fileChecksMethod = /WithValidMethods|SigningMethod|\.Method\b/.test(ctx.code);
+      for (const call of ctx.findCalls(new RegExp(GO_JWT_PARSE.source, "g"))) {
+        if (ctx.isMasked(call.index)) continue;
+        if (/WithValidMethods|SigningMethod|\.Method\b/.test(call.args)) continue;
+        if (fileChecksMethod) continue;
+        out.push({
+          index: call.index,
+          message:
+            "`jwt.Parse` is called without `jwt.WithValidMethods([...])`, and neither the key function nor this file inspects `token.Method` — the token's own header selects the algorithm.",
+        });
+      }
+    }
+
+    return out;
+  },
+};