oauthlint-rules 0.1.0

package/rules/secret/provider-key.yml

@@ -0,0 +1,44 @@
+rules:
+  - id: auth.secret.provider-key
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      A hard-coded credential matching a well-known provider's key format
+      was found in the source. These keys are designed to be revocable —
+      once one ships to git, the only safe action is to rotate it, even
+      if the repo is private.
+
+      Move the value to an environment variable, a secret manager (AWS
+      Secrets Manager, GCP Secret Manager, Doppler, 1Password CLI),
+      or a `.env` file that's `.gitignore`d.
+
+      Detected formats:
+        - Stripe live / test:  sk_live_…  / sk_test_…   / pk_live_…
+        - OpenAI:              sk-…  /  sk-proj-…
+        - Anthropic:           sk-ant-…
+        - GitHub:              ghp_… / gho_… / ghu_… / ghs_… / ghr_… / github_pat_…
+        - Google Workspace:    GOCSPX-…
+        - Google API key:      AIza…
+        - AWS Access Key:      AKIA[0-9A-Z]{16}
+        - Slack Bot / User:    xoxb-… / xoxp-…
+    pattern-either:
+      - pattern-regex: \b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{16,}
+      - pattern-regex: \bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}
+      - pattern-regex: \bgh[opusr]_[A-Za-z0-9]{36,}
+      - pattern-regex: \bgithub_pat_[A-Za-z0-9_]{40,}
+      - pattern-regex: \bGOCSPX-[A-Za-z0-9_-]{20,}
+      - pattern-regex: \bAKIA[0-9A-Z]{16}\b
+      - pattern-regex: \bAIza[0-9A-Za-z_-]{35}\b
+      - pattern-regex: \bxox[bp]-[0-9]{10,}-[0-9]{10,}-[A-Za-z0-9]{20,}
+    metadata:
+      oauthlint-rule-id: AUTH-SECRET-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/secret-provider-key
+      category: security
+      cwe: CWE-798
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      references:
+        - https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/
+        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/

package/rules/session/id-in-url.yml

@@ -0,0 +1,30 @@
+rules:
+  - id: auth.session.id-in-url
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      A session token / id appears in a URL query string. URLs are
+      logged everywhere (web server logs, reverse proxies, browser
+      history, referrer headers leaking to third-party CDNs and ad
+      networks), so this leaks the credential.
+
+      Pass session ids/tokens in the `Authorization` header or in a
+      `Secure; HttpOnly` cookie. Never in the URL.
+
+      OWASP ASVS V3.2 explicitly bans this pattern.
+    pattern-either:
+      - pattern-regex: |-
+              [?&](?:session|sid|sess|auth_token|access_token|refresh_token|token|api[_-]?key|jwt|bearer)=
+      - pattern-regex: |-
+              \?\s*['"]?(?:session|sid|sess|auth_token|access_token|refresh_token|token|api[_-]?key|jwt|bearer)['"]?\s*:
+    metadata:
+      oauthlint-rule-id: AUTH-SESSION-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/session-id-in-url
+      category: security
+      cwe: CWE-598
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      references:
+        - https://owasp.org/www-project-application-security-verification-standard/

package/rules/session/no-regeneration.yml

@@ -0,0 +1,53 @@
+rules:
+  - id: auth.session.no-regeneration
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      The user is being marked as logged in (`req.session.user = ...`,
+      `req.session.userId = ...`, etc.) WITHOUT first regenerating the
+      session id. This opens the door to session-fixation attacks: an
+      attacker who plants a known session id in the victim's browser
+      before login retains access after authentication succeeds.
+
+      Call `req.session.regenerate(cb)` (or your framework's equivalent)
+      between authenticating the credentials and writing the user
+      identity onto the session.
+
+      OWASP ASVS V3.2.1: "The session id must be regenerated on
+      authentication".
+    patterns:
+      - pattern-either:
+          - pattern: '$REQ.session.user = $X'
+          - pattern: '$REQ.session.userId = $X'
+          - pattern: '$REQ.session.user_id = $X'
+          - pattern: '$REQ.session.uid = $X'
+          - pattern: '$REQ.session.authenticated = true'
+          - pattern: '$REQ.session.isAuthenticated = true'
+      # Callback form: assignment inside regenerate's callback.
+      - pattern-not-inside: |
+          $REQ.session.regenerate(...)
+      # Promisified async form: `await new Promise(r => req.session.regenerate(...))`
+      # immediately before the assignment. Scoped to regenerate so it does NOT
+      # suppress assignments that merely follow some unrelated await.
+      - pattern-not-inside: |
+          await new Promise(($R) => $REQ.session.regenerate(...));
+          ...
+      - pattern-not-inside: |
+          await new Promise(($R, $J) => $REQ.session.regenerate(...));
+          ...
+      - pattern-not-inside: |
+          await promisify($REQ.session.regenerate)(...);
+          ...
+    metadata:
+      oauthlint-rule-id: AUTH-SESSION-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/session-no-regeneration
+      category: security
+      cwe: CWE-384
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - express
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renew-the-session-id-after-any-privilege-level-change