oauthlint-rules 0.1.0 → 0.2.0

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,yCAAuC,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAclC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAUxE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuCpB,CAAC;AAEJ,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,yCAAuC,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAUxE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CpB,CAAC;AAEJ,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/schema.js

@@ -11,8 +11,10 @@ export const SeveritySchema = z.enum(['INFO', 'WARNING', 'ERROR']);
  * Claude Code, Copilot, Gemini Code Assist).
  */
 export const OAuthLintMetadataSchema = z.object({
-    'oauthlint-rule-id': z.string().regex(/^AUTH-[A-Z]+-\d{3}$/, {
-        message: 'oauthlint-rule-id must match AUTH-<CATEGORY>-<NNN>',
+    // AUTH-<CATEGORY>-<NNN> for the JS/TS pack (e.g. AUTH-JWT-001); language
+    // packs add a language segment (e.g. AUTH-PY-JWT-001).
+    'oauthlint-rule-id': z.string().regex(/^AUTH-[A-Z]+(-[A-Z]+)*-\d{3}$/, {
+        message: 'oauthlint-rule-id must match AUTH-<CATEGORY>-<NNN> (optionally AUTH-<LANG>-<CATEGORY>-<NNN>)',
     }),
     'oauthlint-doc-url': z.string().url(),
     category: z.literal('security'),
@@ -32,8 +34,12 @@ export const OAuthLintMetadataSchema = z.object({
 const PatternEntrySchema = z.lazy(() => z.union([z.string(), z.record(z.string(), z.unknown()), z.array(PatternEntrySchema)]));
 export const RuleSchema = z
     .object({
-    id: z.string().regex(/^auth\.[a-z][a-z0-9-]*\.[a-z][a-z0-9-]*$/, {
-        message: 'Rule id must follow auth.<category>.<name> (kebab-case)',
+    // auth.<category>.<name> for the JS/TS pack; language packs prepend a
+    // language segment — auth.<lang>.<category>.<name> (e.g. auth.py.jwt.no-verify).
+    // The optional middle segment keeps every existing JS/TS id (and its
+    // published doc URL) untouched while making the scheme language-scalable.
+    id: z.string().regex(/^auth\.([a-z][a-z0-9]*\.)?[a-z][a-z0-9-]*\.[a-z][a-z0-9-]*$/, {
+        message: 'Rule id must follow auth.<category>.<name> or auth.<lang>.<category>.<name> (kebab-case)',
     }),
     languages: z.array(z.string()).min(1),
     severity: SeveritySchema,

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE;QAC3D,OAAO,EAAE,oDAAoD;KAC9D,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/B,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,kBAAkB,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACtF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0CAA0C,EAAE;QAC/D,OAAO,EAAE,yDAAyD;KACnE,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,wCAAwC,CAAC;IACrE,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uCAAuC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,SAAS;IAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,SAAS;IACpC,IAAI,CAAC,QAAQ,KAAK,SAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS;IACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,SAAS;IAC1C,qEAAqE;IACrE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACrC,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,EACxC;IACE,OAAO,EACL,6IAA6I;CAChJ,CACF,CAAC;AAIJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,yEAAyE;IACzE,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;QACrE,OAAO,EACL,8FAA8F;KACjG,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/B,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,kBAAkB,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACtF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,sEAAsE;IACtE,iFAAiF;IACjF,qEAAqE;IACrE,0EAA0E;IAC1E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE;QAClF,OAAO,EACL,0FAA0F;KAC7F,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,wCAAwC,CAAC;IACrE,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uCAAuC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,SAAS;IAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,SAAS;IACpC,IAAI,CAAC,QAAQ,KAAK,SAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS;IACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,SAAS;IAC1C,qEAAqE;IACrE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACrC,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,EACxC;IACE,OAAO,EACL,6IAA6I;CAChJ,CACF,CAAC;AAIJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",
@@ -22,21 +22,28 @@
   "keywords": [
     "oauthlint",
     "semgrep",
+    "semgrep-rules",
     "oauth",
+    "oauth2",
     "oidc",
     "jwt",
     "security",
+    "appsec",
     "sast",
+    "static-analysis",
+    "linter",
+    "cwe",
+    "owasp",
     "auth",
     "ai-code"
   ],
   "dependencies": {
-    "yaml": "2.6.1",
+    "fast-glob": "3.3.3",
+    "yaml": "2.9.0",
     "zod": "3.24.1"
   },
   "devDependencies": {
     "@types/node": "22.10.5",
-    "fast-glob": "3.3.3",
     "typescript": "5.7.3",
     "vitest": "2.1.9"
   },

package/rules/cors/null-origin.yml

@@ -0,0 +1,53 @@
+rules:
+  - id: auth.cors.null-origin
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      CORS is configured to allow the literal origin `'null'`. Sandboxed
+      iframes, documents loaded from `file://`, and certain cross-origin
+      redirects send `Origin: null`. Adding the string `'null'` to your
+      CORS policy therefore grants cross-origin access to ANY such context
+      — including an attacker's sandboxed iframe — which defeats the
+      same-origin policy. Combined with credentials this becomes a
+      CSRF / data-exfiltration primitive.
+
+      The `'null'` origin is not a safe sentinel and cannot be trusted:
+      it is not bound to any host. Remove it from the allowlist entirely.
+
+      Use an explicit allowlist of real, trusted origins instead:
+       - `cors({ origin: 'https://app.example.com', credentials: true })`
+       - `cors({ origin: ['https://app.example.com', 'https://admin.example.com'] })`
+
+      Never set `Access-Control-Allow-Origin` to the string `'null'` and
+      never include `'null'` in a CORS origin allowlist.
+    pattern-either:
+      # Manual header write: ACAO set to the literal string "null".
+      - pattern: $RES.setHeader("Access-Control-Allow-Origin", "null")
+      - pattern: $RES.header("Access-Control-Allow-Origin", "null")
+      - pattern: $RES.set("Access-Control-Allow-Origin", "null")
+      # express cors() middleware: origin is the literal string "null".
+      - pattern: 'cors({ ..., origin: "null", ... })'
+      # express cors() middleware: allowlist array literal that contains "null".
+      - pattern: 'cors({ ..., origin: [..., "null", ...], ... })'
+      # An allowlist array variable containing "null" that is then used as the
+      # cors() origin (handles the indirected `const allowed = [..., 'null']`).
+      - patterns:
+          - pattern: 'cors({ ..., origin: $ALLOWED, ... })'
+          - pattern-inside: |
+              $ALLOWED = [..., "null", ...];
+              ...
+    metadata:
+      oauthlint-rule-id: AUTH-CORS-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/cors-null-origin
+      category: security
+      cwe: CWE-942
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - cors
+        - express
+      references:
+        - https://portswigger.net/web-security/cors
+        - https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS

package/rules/cors/reflect-origin.yml

@@ -0,0 +1,68 @@
+rules:
+  - id: auth.cors.reflect-origin
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      CORS is configured to echo the request's `Origin` back as
+      `Access-Control-Allow-Origin`. Reflecting the incoming origin is
+      functionally identical to allowing EVERY origin: any site can make
+      cross-origin requests and read the responses. Combined with
+      credentials this becomes a CSRF / account-takeover primitive, because
+      the browser will attach the victim's cookies to the attacker-controlled
+      request.
+
+      This is distinct from a literal `*` wildcard — here the origin is
+      reflected dynamically, which silently defeats the same-origin policy
+      while looking "scoped" in code review.
+
+      Use an explicit allowlist of trusted origins instead:
+       - `cors({ origin: 'https://app.example.com', credentials: true })`
+       - `cors({ origin: ['https://app.example.com', 'https://admin.example.com'] })`
+       - a callback that validates against an allowlist before calling
+         `cb(null, true)`.
+
+      Never set `Access-Control-Allow-Origin` to `req.headers.origin`, never
+      use `origin: true`, and never write a callback that unconditionally
+      returns `cb(null, true)`.
+    pattern-either:
+      # Manual header write: ACAO set to the request's origin in any form
+      # (req.headers.origin, req.header('origin'), req.get('Origin'), ...).
+      - pattern: $RES.setHeader("Access-Control-Allow-Origin", $REQ.headers.origin)
+      - pattern: $RES.header("Access-Control-Allow-Origin", $REQ.headers.origin)
+      - pattern: $RES.set("Access-Control-Allow-Origin", $REQ.headers.origin)
+      - pattern: $RES.setHeader("Access-Control-Allow-Origin", $REQ.headers["origin"])
+      - pattern: $RES.header("Access-Control-Allow-Origin", $REQ.headers["origin"])
+      - pattern: $RES.set("Access-Control-Allow-Origin", $REQ.headers["origin"])
+      - pattern: $RES.setHeader("Access-Control-Allow-Origin", $REQ.header("origin"))
+      - pattern: $RES.setHeader("Access-Control-Allow-Origin", $REQ.get("origin"))
+      - pattern: $RES.setHeader("Access-Control-Allow-Origin", $REQ.get("Origin"))
+      # express cors() middleware: origin: true echoes the request origin back.
+      - pattern: 'cors({ ..., origin: true, ... })'
+      # express cors() middleware: a callback that unconditionally allows
+      # every origin (cb(null, true) regardless of the origin argument).
+      - pattern: 'cors({ ..., origin: ($O, $CB) => $CB(null, true), ... })'
+      - patterns:
+          - pattern: |
+              cors({ ..., origin: ($O, $CB) => { ... }, ... })
+          - pattern-inside: |
+              cors({ ..., origin: ($O, $CB) => { ... return $CB(null, true); }, ... })
+      - patterns:
+          - pattern: |
+              cors({ ..., origin: function ($O, $CB) { ... }, ... })
+          - pattern-inside: |
+              cors({ ..., origin: function ($O, $CB) { ... return $CB(null, true); }, ... })
+    metadata:
+      oauthlint-rule-id: AUTH-CORS-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/cors-reflect-origin
+      category: security
+      cwe: CWE-942
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - cors
+        - express
+      references:
+        - https://portswigger.net/web-security/cors
+        - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

package/rules/flow/credentials-in-url.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: auth.flow.credentials-in-url
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      A secret credential is placed in a URL query string. URLs leak into
+      server access logs, reverse-proxy logs, browser history, and the
+      `Referer` header (sent to every third-party CDN, analytics, and ad
+      script on the destination page) — so any of `password`, `client_secret`,
+      `api_key`, `apikey`, or `secret` in the query is a leaked credential.
+
+      Send credentials in the POST request body or in the `Authorization`
+      header. Never in the URL.
+
+      OWASP ASVS V3.2 / CWE-598 explicitly forbid credentials in URL
+      parameters.
+    # `access_token` is deliberately NOT matched: passing it as a query
+    # parameter to a provider's userinfo/API endpoint is a legitimate (and
+    # sometimes mandated) server-side OAuth pattern — flagging it produces
+    # false positives on real provider integrations. Bearer tokens in URLs
+    # are still covered by auth.jwt.in-url for JWT-shaped tokens.
+    pattern-either:
+      # Credential name in a query string (literal or template-built URL).
+      - pattern-regex: '[?&](?:password|client_secret|api_key|apikey|secret)='
+      # URLSearchParams / params builder: .set('client_secret', ...) / .append('secret', ...)
+      - pattern-regex: '\.(?:set|append)\s*\(\s*[''"`](?:password|client_secret|api_key|apikey|secret)[''"`]'
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-009
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-credentials-in-url
+      category: security
+      cwe: CWE-598
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      references:
+        - https://owasp.org/www-project-application-security-verification-standard/

package/rules/flow/secret-in-log.yml

@@ -0,0 +1,95 @@
+rules:
+  - id: auth.flow.secret-in-log
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      A secret-shaped value (`password`, `token`, `secret`, `apiKey`,
+      `accessToken`, `refreshToken`, `privateKey`, `clientSecret`, …) is
+      being passed to a logging call (`console.*` or `logger.*`). Logs are
+      routinely written to files, shipped to aggregators (Datadog, Splunk,
+      CloudWatch) and read by people who should never see the raw secret —
+      this is a textbook credential leak.
+
+      Never log secrets. Redact or mask them before logging
+      (`token.slice(0, 4) + '…'`), log a non-sensitive identifier instead
+      (a user id, a key id), or drop the field entirely.
+    # FP control: we only fire when a logging call receives an *identifier*
+    # whose name ends with a secret word. The argument may sit at any position
+    # (`$...A, $SECRET, $...B`). The `metavariable-pattern` with a bare-identifier
+    # `pattern-regex` forces `$SECRET` to be an identifier (or, in the template
+    # arms, an interpolated identifier) — NOT a string literal or member access,
+    # so status messages like `console.log('password updated')`,
+    # `console.log('reset token sent')` and `console.log(user.id)` are excluded.
+    # The outer `metavariable-regex` then requires the identifier name itself to
+    # match a secret word (re-using the suffix list from
+    # auth.flow.timing-unsafe-compare).
+    pattern-either:
+      # console.log/info/debug/warn/error(... secretVar ...) — secret at any position
+      - patterns:
+          - pattern-either:
+              - pattern: console.log($...A, $SECRET, $...B)
+              - pattern: console.info($...A, $SECRET, $...B)
+              - pattern: console.debug($...A, $SECRET, $...B)
+              - pattern: console.warn($...A, $SECRET, $...B)
+              - pattern: console.error($...A, $SECRET, $...B)
+          - metavariable-pattern:
+              metavariable: $SECRET
+              pattern-regex: ^[A-Za-z_$][A-Za-z0-9_$]*$
+          - metavariable-regex:
+              metavariable: $SECRET
+              regex: (?i)^(?:password|passwd|pwd|secret|token|apikey|api_key|accesstoken|refreshtoken|privatekey|clientsecret)$
+      # logger.<level>(... secretVar ...)
+      - patterns:
+          - pattern: $LOG.$LEVEL($...A, $SECRET, $...B)
+          - metavariable-regex:
+              metavariable: $LOG
+              regex: (?i)^.*log(?:ger)?$
+          - metavariable-regex:
+              metavariable: $LEVEL
+              regex: ^(?:log|info|debug|warn|warning|error|trace|fatal|verbose|silly)$
+          - metavariable-pattern:
+              metavariable: $SECRET
+              pattern-regex: ^[A-Za-z_$][A-Za-z0-9_$]*$
+          - metavariable-regex:
+              metavariable: $SECRET
+              regex: (?i)^(?:password|passwd|pwd|secret|token|apikey|api_key|accesstoken|refreshtoken|privatekey|clientsecret)$
+      # Template-literal interpolation: console.log(`token=${token}`)
+      - patterns:
+          - pattern-either:
+              - pattern: console.log(`...${$SECRET}...`)
+              - pattern: console.info(`...${$SECRET}...`)
+              - pattern: console.debug(`...${$SECRET}...`)
+              - pattern: console.warn(`...${$SECRET}...`)
+              - pattern: console.error(`...${$SECRET}...`)
+          - metavariable-pattern:
+              metavariable: $SECRET
+              pattern-regex: ^[A-Za-z_$][A-Za-z0-9_$]*$
+          - metavariable-regex:
+              metavariable: $SECRET
+              regex: (?i)^(?:password|passwd|pwd|secret|token|apikey|api_key|accesstoken|refreshtoken|privatekey|clientsecret)$
+      - patterns:
+          - pattern: $LOG.$LEVEL(`...${$SECRET}...`)
+          - metavariable-regex:
+              metavariable: $LOG
+              regex: (?i)^.*log(?:ger)?$
+          - metavariable-regex:
+              metavariable: $LEVEL
+              regex: ^(?:log|info|debug|warn|warning|error|trace|fatal|verbose|silly)$
+          - metavariable-pattern:
+              metavariable: $SECRET
+              pattern-regex: ^[A-Za-z_$][A-Za-z0-9_$]*$
+          - metavariable-regex:
+              metavariable: $SECRET
+              regex: (?i)^(?:password|passwd|pwd|secret|token|apikey|api_key|accesstoken|refreshtoken|privatekey|clientsecret)$
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-008
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-secret-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/flow/timing-unsafe-compare.yml

@@ -38,14 +38,37 @@ rules:
           - pattern-not: 'typeof $X !== $Y'
           - pattern-not: 'typeof $X == $Y'
           - pattern-not: 'typeof $X != $Y'
-          - pattern-not: '$X === ""'
-          - pattern-not: "$X === ''"
-          - pattern-not: '$X !== ""'
-          - pattern-not: "$X !== ''"
-          - pattern-not: '$X == ""'
-          - pattern-not: "$X == ''"
-          - pattern-not: '$X != ""'
-          - pattern-not: "$X != ''"
+          # A secret-named value compared to a *literal* is never the
+          # timing target: a literal baked into source is already public,
+          # so there is no secret to leak byte-by-byte. This covers demo
+          # passwords (`pw !== "password"`), feature flags
+          # (`idToken === false`) and status checks — the dominant FP
+          # class on next-auth in real-world validation. `"..."` matches
+          # any string literal (including the empty string).
+          - pattern-not: '$X === "..."'
+          - pattern-not: '$X !== "..."'
+          - pattern-not: '$X == "..."'
+          - pattern-not: '$X != "..."'
+          - pattern-not: '"..." === $X'
+          - pattern-not: '"..." !== $X'
+          - pattern-not: '"..." == $X'
+          - pattern-not: '"..." != $X'
+          - pattern-not: '$X === true'
+          - pattern-not: '$X !== true'
+          - pattern-not: '$X == true'
+          - pattern-not: '$X != true'
+          - pattern-not: '$X === false'
+          - pattern-not: '$X !== false'
+          - pattern-not: '$X == false'
+          - pattern-not: '$X != false'
+          - pattern-not: 'true === $X'
+          - pattern-not: 'true !== $X'
+          - pattern-not: 'true == $X'
+          - pattern-not: 'true != $X'
+          - pattern-not: 'false === $X'
+          - pattern-not: 'false !== $X'
+          - pattern-not: 'false == $X'
+          - pattern-not: 'false != $X'
           - pattern-not: '$X.length === $N'
           - pattern-not: '$X.length !== $N'
           - pattern-not: '$X.length == $N'
@@ -71,14 +94,37 @@ rules:
           - pattern-not: 'typeof $X !== $Y'
           - pattern-not: 'typeof $X == $Y'
           - pattern-not: 'typeof $X != $Y'
-          - pattern-not: '$X === ""'
-          - pattern-not: "$X === ''"
-          - pattern-not: '$X !== ""'
-          - pattern-not: "$X !== ''"
-          - pattern-not: '$X == ""'
-          - pattern-not: "$X == ''"
-          - pattern-not: '$X != ""'
-          - pattern-not: "$X != ''"
+          # A secret-named value compared to a *literal* is never the
+          # timing target: a literal baked into source is already public,
+          # so there is no secret to leak byte-by-byte. This covers demo
+          # passwords (`pw !== "password"`), feature flags
+          # (`idToken === false`) and status checks — the dominant FP
+          # class on next-auth in real-world validation. `"..."` matches
+          # any string literal (including the empty string).
+          - pattern-not: '$X === "..."'
+          - pattern-not: '$X !== "..."'
+          - pattern-not: '$X == "..."'
+          - pattern-not: '$X != "..."'
+          - pattern-not: '"..." === $X'
+          - pattern-not: '"..." !== $X'
+          - pattern-not: '"..." == $X'
+          - pattern-not: '"..." != $X'
+          - pattern-not: '$X === true'
+          - pattern-not: '$X !== true'
+          - pattern-not: '$X == true'
+          - pattern-not: '$X != true'
+          - pattern-not: '$X === false'
+          - pattern-not: '$X !== false'
+          - pattern-not: '$X == false'
+          - pattern-not: '$X != false'
+          - pattern-not: 'true === $X'
+          - pattern-not: 'true !== $X'
+          - pattern-not: 'true == $X'
+          - pattern-not: 'true != $X'
+          - pattern-not: 'false === $X'
+          - pattern-not: 'false !== $X'
+          - pattern-not: 'false == $X'
+          - pattern-not: 'false != $X'
           - pattern-not: '$X.length === $N'
           - pattern-not: '$X.length !== $N'
           - pattern-not: '$X.length == $N'

package/rules/flow/weak-bcrypt-rounds.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.flow.weak-bcrypt-rounds
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      A bcrypt cost factor below 10 was used. A low work factor makes the
+      hash cheap to compute, which lets an attacker brute-force stolen
+      password hashes far too quickly. OWASP recommends a bcrypt cost of at
+      least 10, and ≥ 12 for new applications, tuned so a single hash takes
+      roughly 250ms on your hardware.
+
+      Common LLM-generated mistake: `bcrypt.hash(pw, 8)` or
+      `bcrypt.genSalt(5)` because the literal "looks fast enough". Raise the
+      cost factor to 12 or higher.
+    patterns:
+      - pattern-either:
+          - pattern: bcrypt.hash($PW, $N)
+          - pattern: bcrypt.hash($PW, $N, ...)
+          - pattern: bcrypt.hashSync($PW, $N)
+          - pattern: bcrypt.hashSync($PW, $N, ...)
+          - pattern: bcrypt.genSalt($N)
+          - pattern: bcrypt.genSalt($N, ...)
+          - pattern: bcrypt.genSaltSync($N)
+          - pattern: bcrypt.genSaltSync($N, ...)
+      - metavariable-comparison:
+          metavariable: $N
+          comparison: $N < 10
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-007
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-weak-bcrypt-rounds
+      category: security
+      cwe: CWE-916
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - bcrypt
+        - bcryptjs
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

package/rules/flow/weak-password-hash.yml

@@ -0,0 +1,74 @@
+rules:
+  - id: auth.flow.weak-password-hash
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      A password is being hashed with a fast, general-purpose hash
+      (MD5/SHA-1/SHA-256/SHA-512 via `crypto.createHash`). These functions
+      are designed to be FAST, so an attacker who steals the database can
+      brute-force billions of candidate passwords per second on commodity
+      GPUs. Salting alone does not fix this.
+
+      Use a dedicated, deliberately-slow password hashing function instead:
+      `bcrypt`, `argon2` (argon2id), or `scrypt` (`crypto.scrypt`). These add
+      a tunable work factor that makes large-scale brute-forcing infeasible.
+    # Anchored on the *name* of the hashed value: we only flag when the value
+    # passed to `.update(...)` is named like a password. This avoids the
+    # common FP class — checksums, file digests (`createHash('sha256')
+    # .update(fileBuffer)`), and HMAC signatures (`createHmac`) are NOT
+    # password hashing and must not be flagged.
+    pattern-either:
+      # Chained form: createHash('md5').update(password).digest(...)
+      - patterns:
+          - pattern-either:
+              - pattern: crypto.createHash($ALGO).update($PW).digest(...)
+              - pattern: createHash($ALGO).update($PW).digest(...)
+              - pattern: crypto.createHash($ALGO).update($PW, ...).digest(...)
+              - pattern: createHash($ALGO).update($PW, ...).digest(...)
+          - metavariable-regex:
+              metavariable: $ALGO
+              regex: ^(["'])(?i)(md5|sha1|sha-1|sha224|sha256|sha-256|sha384|sha512|sha-512)\1$
+          - metavariable-pattern:
+              metavariable: $PW
+              patterns:
+                - pattern: $PWNAME
+                - metavariable-regex:
+                    metavariable: $PWNAME
+                    regex: (?i)^.*(password|passwd|pwd)$
+      # Two-step form:
+      #   const h = crypto.createHash('sha256'); h.update(password); h.digest(...)
+      - patterns:
+          - pattern-either:
+              - pattern: $H.update($PW)
+              - pattern: $H.update($PW, ...)
+          - metavariable-pattern:
+              metavariable: $PW
+              patterns:
+                - pattern: $PWNAME
+                - metavariable-regex:
+                    metavariable: $PWNAME
+                    regex: (?i)^.*(password|passwd|pwd)$
+          - pattern-either:
+              - pattern-inside: |
+                  $H = crypto.createHash($ALGO);
+                  ...
+              - pattern-inside: |
+                  $H = createHash($ALGO);
+                  ...
+          - metavariable-regex:
+              metavariable: $ALGO
+              regex: ^(["'])(?i)(md5|sha1|sha-1|sha224|sha256|sha-256|sha384|sha512|sha-512)\1$
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-weak-password-hash
+      category: security
+      cwe: CWE-916
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - node:crypto
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/916.html

package/rules/go/cookie/insecure.yml

@@ -0,0 +1,35 @@
+rules:
+  - id: auth.go.cookie.insecure
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A session/auth `http.Cookie` is created with a security attribute
+      explicitly disabled (`Secure: false` or `HttpOnly: false`). With
+      `Secure: false` the cookie is sent over plain HTTP, so a network
+      attacker can read the session token. With `HttpOnly: false` the cookie
+      is readable from JavaScript, so any XSS can steal it. For OAuth/OIDC
+      this exposes session and token cookies to theft and hijacking.
+
+      Set `Secure: true` and `HttpOnly: true` on auth cookies, and add an
+      appropriate `SameSite` mode (for example `SameSite: http.SameSiteLaxMode`).
+    # Matches only the literal `false`. `Secure: true`, `HttpOnly: true`, and
+    # the absence of the field are not flagged. Works for `http.Cookie{...}`
+    # and `&http.Cookie{...}` (the composite literal matches inside the
+    # address-of).
+    patterns:
+      - pattern-either:
+          - pattern: 'http.Cookie{..., Secure: false, ...}'
+          - pattern: 'http.Cookie{..., HttpOnly: false, ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-GO-COOKIE-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-cookie-insecure
+      category: security
+      cwe: CWE-614
+      owasp: A05:2021
+      llm-prevalence: HIGH
+      technology:
+        - net/http
+      references:
+        - https://pkg.go.dev/net/http#Cookie
+        - https://cwe.mitre.org/data/definitions/614.html

package/rules/go/cors/allow-all.yml

@@ -0,0 +1,44 @@
+rules:
+  - id: auth.go.cors.allow-all
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      CORS is configured to allow every origin with the wildcard `*`. Any
+      website can then make cross-origin requests to this endpoint, defeating
+      the same-origin policy (CWE-942). This is a common AI-generated mistake —
+      `AllowAllOrigins: true`, `AllowedOrigins: []string{"*"}`, or a raw
+      `Access-Control-Allow-Origin: *` header is pasted in to "make the browser
+      call work" and the intended scope is never added. Combined with
+      credentials this becomes an account-takeover primitive that leaks
+      OAuth/OIDC tokens cross-origin.
+
+      Restrict CORS to an explicit allowlist of trusted origins instead, for
+      example `AllowOrigins: []string{"https://app.example.com"}` (gin-contrib),
+      `AllowedOrigins: []string{"https://app.example.com"}` (rs/cors), or
+      `w.Header().Set("Access-Control-Allow-Origin", "https://app.example.com")`.
+    # Covers gin-contrib/cors (`cors.Config{..., AllowAllOrigins: true, ...}`),
+    # rs/cors (`cors.Options{..., AllowedOrigins: []string{..., "*", ...}, ...}`
+    # whose list literal contains the wildcard `"*"`), and the raw header
+    # `$W.Header().Set("Access-Control-Allow-Origin", "*")`. Only the wildcard /
+    # `AllowAllOrigins: true` is flagged — explicit origins such as
+    # `"https://app.example.com"` are not.
+    pattern-either:
+      - pattern: 'cors.Config{..., AllowAllOrigins: true, ...}'
+      - pattern: 'cors.Options{..., AllowedOrigins: []string{..., "*", ...}, ...}'
+      - pattern: '$W.Header().Set("Access-Control-Allow-Origin", "*")'
+    metadata:
+      oauthlint-rule-id: AUTH-GO-CORS-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-cors-allow-all
+      category: security
+      cwe: CWE-942
+      owasp: A05:2021
+      llm-prevalence: HIGH
+      technology:
+        - gin
+        - rs-cors
+        - net/http
+      references:
+        - https://github.com/gin-contrib/cors
+        - https://github.com/rs/cors
+        - https://cwe.mitre.org/data/definitions/942.html