oauthlint-rules 0.1.1 → 0.2.0

package/rules/go/crypto/bcrypt-low-cost.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: auth.go.crypto.bcrypt-low-cost
+    languages:
+      - go
+    severity: WARNING
+    message: |
+      `bcrypt.GenerateFromPassword` is called with a cost factor below 10. A
+      low work factor makes each hash cheap to compute, which lets an attacker
+      brute-force stolen password hashes far too quickly. OWASP recommends a
+      bcrypt cost of at least 10, and ≥ 12 for new applications, tuned so a
+      single hash takes roughly 250ms on your hardware.
+
+      Common LLM-generated mistake: `bcrypt.GenerateFromPassword(pw, 8)`
+      because the literal "looks fast enough". Use `bcrypt.DefaultCost` (10)
+      or raise the cost factor to 12 or higher.
+    # Matches only a numeric literal cost < 10 passed to
+    # `bcrypt.GenerateFromPassword`. `metavariable-comparison` constrains $N to
+    # numeric literals only, so `bcrypt.DefaultCost`, a cost ≥ 10, or a
+    # variable (`bcrypt.GenerateFromPassword(pw, cost)`) are NOT flagged.
+    patterns:
+      - pattern: bcrypt.GenerateFromPassword($PW, $N)
+      - metavariable-comparison:
+          metavariable: $N
+          comparison: $N < 10
+    metadata:
+      oauthlint-rule-id: AUTH-GO-CRYPTO-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-crypto-bcrypt-low-cost
+      category: security
+      cwe: CWE-916
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - bcrypt
+      references:
+        - https://pkg.go.dev/golang.org/x/crypto/bcrypt#GenerateFromPassword
+        - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/916.html

package/rules/go/crypto/weak-cipher.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.go.crypto.weak-cipher
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A broken or deprecated block/stream cipher is used to protect data. DES
+      (`des.NewCipher`) and 3DES (`des.NewTripleDESCipher`) have a 64-bit block
+      and are considered insecure (Sweet32, brute-force), while RC4
+      (`rc4.NewCipher`) has well-known keystream biases and is forbidden by RFC
+      7465. For OAuth/OIDC this means tokens, client secrets, and other
+      sensitive material are not adequately protected and may be recovered by
+      an attacker.
+
+      Use authenticated AES instead: load the key with `crypto/aes`
+      (`aes.NewCipher(key)`) and wrap it in `cipher.NewGCM(block)` to get
+      AES-GCM, which provides both confidentiality and integrity.
+    # Flags only the broken ciphers DES, 3DES, and RC4. `aes.NewCipher(...)`
+    # is intentionally not matched.
+    patterns:
+      - pattern-either:
+          - pattern: des.NewCipher(...)
+          - pattern: des.NewTripleDESCipher(...)
+          - pattern: rc4.NewCipher(...)
+    metadata:
+      oauthlint-rule-id: AUTH-GO-CRYPTO-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-crypto-weak-cipher
+      category: security
+      cwe: CWE-327
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - crypto/des
+        - crypto/rc4
+      references:
+        - https://pkg.go.dev/crypto/aes#NewCipher
+        - https://pkg.go.dev/crypto/cipher#NewGCM
+        - https://cwe.mitre.org/data/definitions/327.html

package/rules/go/crypto/weak-password-hash.yml

@@ -0,0 +1,47 @@
+rules:
+  - id: auth.go.crypto.weak-password-hash
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A password is being hashed with a fast, general-purpose digest from the
+      Go standard library (MD5, SHA-1, SHA-256, SHA-512). These algorithms are
+      designed to be fast, which makes offline brute-force and rainbow-table
+      attacks cheap — they are NOT suitable for storing passwords (CWE-916).
+
+      Use a dedicated, slow password-hashing function with a per-password salt
+      and a tunable work factor: bcrypt
+      (`golang.org/x/crypto/bcrypt.GenerateFromPassword`), Argon2
+      (`golang.org/x/crypto/argon2.IDKey`), or scrypt
+      (`golang.org/x/crypto/scrypt.Key`). These resist brute-force by design.
+    # Anchored to the *password* character of the input: the digested/written
+    # argument must be named like a password (metavariable-regex on $PW). This
+    # avoids flagging `sha256.Sum256(fileBytes)` for file checksums or
+    # non-password fingerprints, and does not touch real password hashers
+    # (bcrypt/argon2/scrypt). Both the one-shot `Sum`/`Sum256`/`Sum512` form
+    # and the streaming `h := md5.New(); h.Write([]byte(password))` writer form
+    # are covered.
+    patterns:
+      - pattern-either:
+          - pattern: md5.Sum([]byte($PW))
+          - pattern: sha1.Sum([]byte($PW))
+          - pattern: sha256.Sum256([]byte($PW))
+          - pattern: sha512.Sum512([]byte($PW))
+          - pattern: $H.Write([]byte($PW))
+      - metavariable-regex:
+          metavariable: $PW
+          regex: (?i).*(password|passwd|pwd).*
+    metadata:
+      oauthlint-rule-id: AUTH-GO-CRYPTO-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-crypto-weak-password-hash
+      category: security
+      cwe: CWE-916
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - crypto/md5
+        - crypto/sha256
+      references:
+        - https://cwe.mitre.org/data/definitions/916.html
+        - https://pkg.go.dev/golang.org/x/crypto/bcrypt
+        - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

package/rules/go/flow/weak-rand.yml

@@ -0,0 +1,61 @@
+rules:
+  - id: auth.go.flow.weak-rand
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A security-sensitive value — its name indicates a token, secret, key,
+      password, nonce, OTP, or salt — is being generated with the `math/rand`
+      package. `math/rand` is a deterministic PRNG: its output is predictable
+      and an attacker who observes enough values can recover the seed and
+      forecast every future token. For OAuth/OIDC this means forgeable
+      `state` values, guessable authorization codes, and predictable refresh
+      tokens.
+
+      Use `crypto/rand` instead: allocate a byte slice and fill it with
+      `rand.Read(b)` (from `crypto/rand`), then hex- or base64url-encode it.
+      Never derive a credential from `math/rand`.
+    # We match `rand.$F(...)` where $F is one of the math/rand-EXCLUSIVE
+    # generators (Intn/Int/Int31/Int63/Float64/Perm). These do not exist in
+    # crypto/rand, so a match is unambiguous. We deliberately do NOT match
+    # `rand.Read(...)`, which exists in BOTH packages — the crypto/rand one is
+    # the safe path.
+    #
+    # The result must be assigned (`:=` or `=`) to a secret-shaped identifier;
+    # `i := rand.Intn(10)` for a loop or `delay := rand.Intn(500)` for jitter
+    # are not flagged. The name constraint uses `metavariable-pattern` +
+    # `pattern-regex` (rather than `metavariable-regex`) so that $VAR is
+    # recorded as a distinguishing binding — otherwise Semgrep's Go frontend
+    # leaves the short-var-decl LHS unbound and collapses two genuinely
+    # distinct secrets into a single finding.
+    pattern-either:
+      - patterns:
+          - pattern: '$VAR := rand.$F(...)'
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(Intn|Int|Int31|Int63|Float64|Perm)$
+          - metavariable-pattern:
+              metavariable: $VAR
+              patterns:
+                - pattern-regex: (?i)(token|secret|key|password|nonce|otp|salt)
+      - patterns:
+          - pattern: '$VAR = rand.$F(...)'
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(Intn|Int|Int31|Int63|Float64|Perm)$
+          - metavariable-pattern:
+              metavariable: $VAR
+              patterns:
+                - pattern-regex: (?i)(token|secret|key|password|nonce|otp|salt)
+    metadata:
+      oauthlint-rule-id: AUTH-GO-FLOW-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-flow-weak-rand
+      category: security
+      cwe: CWE-330
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - math/rand
+      references:
+        - https://pkg.go.dev/crypto/rand#Read
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/go/jwt/hardcoded-secret.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: auth.go.jwt.hardcoded-secret
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A JWT HMAC signing/verification key is hardcoded as a string literal in a
+      call to golang-jwt. Anyone who can read the source or git history can
+      forge or tamper with tokens, which is a complete authentication bypass.
+
+      Load the secret from the environment or a secret manager instead, e.g.
+      `key := []byte(os.Getenv("JWT_SECRET"))` and `token.SignedString(key)`.
+      Never commit signing keys to source control.
+    # Two shapes are flagged, both requiring the key to be a `[]byte("...")`
+    # built directly from a string literal (the `"..."` metavariadic only
+    # matches a string-literal AST node): the signing side
+    # `tok.SignedString([]byte("x"))`, and a golang-jwt Keyfunc that returns
+    # `[]byte("x")` as the verification key. Because the literal must appear
+    # in key position, `[]byte(os.Getenv("JWT_SECRET"))` and `[]byte(secret)`
+    # (a variable) are NOT matched — only string literals.
+    pattern-either:
+      - pattern: $TOKEN.SignedString([]byte("..."))
+      - patterns:
+          - pattern: return []byte("..."), nil
+          - pattern-inside: 'func(...) (interface{}, error) { ... }'
+    metadata:
+      oauthlint-rule-id: AUTH-GO-JWT-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-jwt-hardcoded-secret
+      category: security
+      cwe: CWE-798
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - golang-jwt
+      references:
+        - https://pkg.go.dev/github.com/golang-jwt/jwt/v5#Token.SignedString
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/go/jwt/none-algorithm.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.go.jwt.none-algorithm
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A JWT is created or accepted with the `none` algorithm, which produces an
+      unsigned token. Anyone can forge such a token by setting `alg: none` and
+      omitting the signature, so the server has no way to verify who issued it —
+      a complete authentication bypass (CWE-347). In golang-jwt this happens
+      when signing with `jwt.SigningMethodNone` or passing the
+      `jwt.UnsafeAllowNoneSignatureType` sentinel to `SignedString`.
+
+      Never use the `none` algorithm. Sign tokens with a real algorithm such as
+      HS256 (`jwt.SigningMethodHS256`), RS256 (`jwt.SigningMethodRS256`), or
+      ES256 (`jwt.SigningMethodES256`) and verify them with the matching key.
+    # Targets code that ENABLES `none`: building a token with
+    # `SigningMethodNone`, or the `UnsafeAllowNoneSignatureType` sentinel (which
+    # is only ever used to allow none). A defensive comparison such as
+    # `token.Method == jwt.SigningMethodNone` to REJECT none is deliberately not
+    # flagged. HS256/RS256/ES256 are never matched.
+    pattern-either:
+      - pattern: jwt.NewWithClaims(jwt.SigningMethodNone, ...)
+      - pattern: jwt.New(jwt.SigningMethodNone, ...)
+      - pattern: jwt.New(jwt.SigningMethodNone)
+      - pattern: jwt.UnsafeAllowNoneSignatureType
+    metadata:
+      oauthlint-rule-id: AUTH-GO-JWT-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-jwt-none-algorithm
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - golang-jwt
+      references:
+        - https://pkg.go.dev/github.com/golang-jwt/jwt/v5#pkg-variables
+        - https://cwe.mitre.org/data/definitions/347.html

package/rules/go/jwt/parse-unverified.yml

@@ -0,0 +1,33 @@
+rules:
+  - id: auth.go.jwt.parse-unverified
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A JWT is decoded with `ParseUnverified`, which parses the token WITHOUT
+      checking its signature. Any claims read from the result are fully
+      attacker-controlled — an attacker can forge arbitrary subjects, scopes,
+      or expiry and the token will still parse. Trusting these claims for
+      authentication or authorization is a complete auth bypass (CWE-347).
+
+      Verify the signature instead: use `jwt.Parse(tok, keyfunc)` or
+      `jwt.ParseWithClaims(tok, claims, keyfunc)` with a `Keyfunc` that returns
+      the expected signing key, so a token with a bad or missing signature is
+      rejected.
+    # Matches the `ParseUnverified` method on any *jwt.Parser receiver:
+    # `parser.ParseUnverified(...)`, `jwt.NewParser().ParseUnverified(...)`,
+    # `new(jwt.Parser).ParseUnverified(...)`. `jwt.Parse(...)` and
+    # `jwt.ParseWithClaims(...)` verify the signature and are NOT matched.
+    pattern: $P.ParseUnverified($TOK, $CLAIMS)
+    metadata:
+      oauthlint-rule-id: AUTH-GO-JWT-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-jwt-parse-unverified
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - golang-jwt
+      references:
+        - https://pkg.go.dev/github.com/golang-jwt/jwt/v5#Parser.ParseUnverified
+        - https://cwe.mitre.org/data/definitions/347.html

package/rules/go/jwt/unchecked-method.yml

@@ -0,0 +1,72 @@
+rules:
+  - id: auth.go.jwt.unchecked-method
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A `Keyfunc` passed to `jwt.Parse`/`jwt.ParseWithClaims` returns the
+      verification key WITHOUT first checking `token.Method` (the signing
+      algorithm). This enables an algorithm-confusion attack: if the server
+      verifies RS256 tokens with an RSA public key, an attacker can forge a
+      token signed with HS256 using that public key as the HMAC secret, and the
+      library will accept it — a complete authentication bypass (CWE-347).
+
+      Always assert the signing method inside the keyfunc before returning the
+      key, e.g.:
+      `if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok { return nil, err }`
+      (or `*jwt.SigningMethodRSA` / `*jwt.SigningMethodECDSA` as appropriate),
+      so a token signed with an unexpected algorithm is rejected.
+    # Matches a keyfunc literal that returns the key directly (`return $KEY, nil`)
+    # and whose body does NOT reference `.Method` (neither a type assertion
+    # `t.Method.(*jwt.SigningMethod...)` nor a comparison `t.Method != ...`).
+    # The `pattern-not` with the `<... $T.Method ...>` deep-expression operator
+    # excludes any keyfunc that inspects the signing method, keeping correct
+    # method-checking keyfuncs from being flagged.
+    patterns:
+      - pattern-either:
+          - pattern: |
+              jwt.Parse($TOK, func($T *jwt.Token) (interface{}, error) {
+                ...
+                return $KEY, nil
+              })
+          - pattern: |
+              jwt.ParseWithClaims($TOK, $CLAIMS, func($T *jwt.Token) (interface{}, error) {
+                ...
+                return $KEY, nil
+              })
+      - pattern-not: |
+          jwt.Parse($TOK, func($T *jwt.Token) (interface{}, error) {
+            ...
+            $T.Method
+            ...
+          })
+      - pattern-not: |
+          jwt.ParseWithClaims($TOK, $CLAIMS, func($T *jwt.Token) (interface{}, error) {
+            ...
+            $T.Method
+            ...
+          })
+      - pattern-not: |
+          jwt.Parse($TOK, func($T *jwt.Token) (interface{}, error) {
+            ...
+            if <... $T.Method ...> { ... }
+            ...
+          })
+      - pattern-not: |
+          jwt.ParseWithClaims($TOK, $CLAIMS, func($T *jwt.Token) (interface{}, error) {
+            ...
+            if <... $T.Method ...> { ... }
+            ...
+          })
+    metadata:
+      oauthlint-rule-id: AUTH-GO-JWT-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-jwt-unchecked-method
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - golang-jwt
+      references:
+        - https://pkg.go.dev/github.com/golang-jwt/jwt/v5#Keyfunc
+        - https://cwe.mitre.org/data/definitions/347.html

package/rules/go/tls/insecure-skip-verify.yml

@@ -0,0 +1,32 @@
+rules:
+  - id: auth.go.tls.insecure-skip-verify
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A `tls.Config` is created with `InsecureSkipVerify: true`, which disables
+      verification of the server's certificate chain and host name. Any
+      attacker who can intercept the connection can present any certificate
+      and read or tamper with the traffic — a classic man-in-the-middle hole.
+      For OAuth/OIDC this leaks authorization codes, access tokens, and client
+      secrets in transit.
+
+      Never set `InsecureSkipVerify: true`. Leave verification on (the default).
+      To trust a private CA in development, set `RootCAs` to a `*x509.CertPool`
+      loaded with that CA instead.
+    # Matches only the literal `true`. `InsecureSkipVerify: false` and the
+    # field's absence are not flagged. Works for `tls.Config{...}` and
+    # `&tls.Config{...}` (the composite literal matches inside the address-of).
+    pattern: 'tls.Config{..., InsecureSkipVerify: true, ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-GO-TLS-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-tls-insecure-skip-verify
+      category: security
+      cwe: CWE-295
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - crypto/tls
+      references:
+        - https://pkg.go.dev/crypto/tls#Config
+        - https://cwe.mitre.org/data/definitions/295.html

package/rules/go/tls/min-version.yml

@@ -0,0 +1,36 @@
+rules:
+  - id: auth.go.tls.min-version
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A `tls.Config` is created with `MinVersion` pinned to an obsolete
+      protocol — SSL 3.0, TLS 1.0, or TLS 1.1. These versions have known
+      cryptographic weaknesses (POODLE, BEAST, downgrade attacks) and are
+      deprecated by RFC 8996. Allowing them lets an attacker negotiate a
+      broken cipher and intercept or tamper with OAuth/OIDC traffic,
+      leaking authorization codes, access tokens, and client secrets.
+
+      Set `MinVersion` to at least `tls.VersionTLS12`, and ideally
+      `tls.VersionTLS13`, so the handshake refuses obsolete protocols.
+    # Matches the obsolete constants only. `tls.VersionTLS12` and
+    # `tls.VersionTLS13` are not flagged. Works for both `tls.Config{...}`
+    # and `&tls.Config{...}` (the composite literal matches inside `&`).
+    patterns:
+      - pattern: 'tls.Config{..., MinVersion: $V, ...}'
+      - metavariable-regex:
+          metavariable: $V
+          regex: ^tls\.(VersionSSL30|VersionTLS10|VersionTLS11)$
+    metadata:
+      oauthlint-rule-id: AUTH-GO-TLS-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-tls-min-version
+      category: security
+      cwe: CWE-326
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - crypto/tls
+      references:
+        - https://pkg.go.dev/crypto/tls#Config
+        - https://datatracker.ietf.org/doc/html/rfc8996
+        - https://cwe.mitre.org/data/definitions/326.html

package/rules/java/cookie/insecure.yml

@@ -0,0 +1,31 @@
+rules:
+  - id: auth.java.cookie.insecure
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      A servlet Cookie is created with a security attribute explicitly
+      disabled. `setSecure(false)` lets the cookie travel over plain HTTP,
+      and `setHttpOnly(false)` makes it readable from JavaScript — either way
+      a session or auth cookie can be intercepted or stolen (CWE-614). This is
+      a common AI-generated mistake where the flag is set to `false` to "make
+      it work" over localhost and never switched back.
+
+      Set `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` on every
+      session or authentication cookie, and add `SameSite` (e.g. `Strict` or
+      `Lax`) to further limit cross-site exposure.
+    pattern-either:
+      - pattern: $C.setSecure(false)
+      - pattern: $C.setHttpOnly(false)
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-COOKIE-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-cookie-insecure
+      category: security
+      cwe: CWE-614
+      owasp: A05:2021
+      llm-prevalence: HIGH
+      technology:
+        - servlet
+      references:
+        - https://owasp.org/www-community/controls/SecureCookieAttribute
+        - https://cwe.mitre.org/data/definitions/614.html

package/rules/java/cors/allow-all.yml

@@ -0,0 +1,47 @@
+rules:
+  - id: auth.java.cors.allow-all
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      CORS is configured to allow every origin with the wildcard `*`. Any
+      website can then make cross-origin requests to this endpoint, defeating
+      the same-origin policy (CWE-942). This is a common AI-generated Spring
+      mistake — `@CrossOrigin(origins = "*")` or `addAllowedOrigin("*")` is
+      pasted in to "make the browser call work" and the intended scope is
+      never added. A bare `@CrossOrigin` (no arguments) also defaults to all
+      origins.
+
+      Restrict CORS to an explicit allowlist of trusted origins instead, e.g.
+      `@CrossOrigin(origins = "https://app.example.com")` or
+      `config.setAllowedOrigins(List.of("https://app.example.com"))`. Note that
+      `addAllowedOriginPattern("*")` combined with `setAllowCredentials(true)`
+      is just as dangerous, because it sends the victim's cookies cross-origin.
+    # Covers the Spring MVC annotation (with an explicit `origins = "*"`, with
+    # the value alias `@CrossOrigin("*")`, and the bare `@CrossOrigin` which
+    # defaults to all origins), plus the programmatic CorsConfiguration API:
+    # `addAllowedOrigin("*")` and `setAllowedOrigins(...)` whose argument is a
+    # list literal containing `"*"` (`List.of("*")`, `Arrays.asList("*")`,
+    # `Collections.singletonList("*")`, ...). Only the literal `"*"` is
+    # flagged — explicit origins like `"https://app.example.com"` are not.
+    pattern-either:
+      - pattern: '@CrossOrigin(origins = "*")'
+      - pattern: '@CrossOrigin(origins = {..., "*", ...})'
+      - pattern: '@CrossOrigin("*")'
+      - pattern: |
+          @CrossOrigin
+          $RET $M(...) { ... }
+      - pattern: $C.addAllowedOrigin("*")
+      - pattern: $C.setAllowedOrigins($L(..., "*", ...))
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CORS-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-cors-allow-all
+      category: security
+      cwe: CWE-942
+      owasp: A05:2021
+      llm-prevalence: HIGH
+      technology:
+        - spring-web
+      references:
+        - https://docs.spring.io/spring-framework/reference/web/webmvc-cors.html
+        - https://cwe.mitre.org/data/definitions/942.html

package/rules/java/crypto/ecb-mode.yml

@@ -0,0 +1,42 @@
+rules:
+  - id: auth.java.crypto.ecb-mode
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      A JCA `Cipher` is being created in ECB mode (or with a bare algorithm
+      alias that defaults to ECB). ECB encrypts each block independently, so
+      identical plaintext blocks produce identical ciphertext blocks — it is
+      deterministic and leaks structure/patterns of the plaintext (CWE-327).
+      `Cipher.getInstance("AES")`, `"DES"`, `"DESede"`, or `"Blowfish"` with no
+      mode specified silently falls back to ECB as well.
+
+      Use an authenticated mode: `Cipher.getInstance("AES/GCM/NoPadding")` with
+      a unique 12-byte IV per message. At minimum use CBC with a random IV plus
+      a separate HMAC (encrypt-then-MAC). Never use ECB or a bare cipher alias.
+    # Match only the transformation string passed to Cipher.getInstance(...).
+    # The metavariable-regex flags either a bare symmetric algorithm alias
+    # (AES / DES / DESede / Blowfish with no mode — these default to ECB) or an
+    # explicit ECB mode on one of those block ciphers (any padding). It is
+    # scoped to symmetric block ciphers on purpose: "AES/GCM/NoPadding" and
+    # "AES/CBC/PKCS5Padding" have a safe mode, and "RSA/ECB/OAEPWith..." is
+    # asymmetric (the "/ECB/" token there is a JCA quirk, not block-ECB), so
+    # none of them match.
+    patterns:
+      - pattern: javax.crypto.Cipher.getInstance($TRANSFORM, ...)
+      - metavariable-regex:
+          metavariable: $TRANSFORM
+          regex: (?i)^"(aes|des|desede|blowfish)(/ecb/.*)?"$
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CRYPTO-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-crypto-ecb-mode
+      category: security
+      cwe: CWE-327
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - javax.crypto
+      references:
+        - https://cwe.mitre.org/data/definitions/327.html
+        - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
+        - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html

package/rules/java/crypto/insecure-random.yml

@@ -0,0 +1,62 @@
+rules:
+  - id: auth.java.crypto.insecure-random
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      A security-sensitive value (token, secret, key, password, nonce, OTP, or
+      salt) is generated with a non-cryptographic PRNG. `java.util.Random` and
+      `Math.random()` are predictable: their output is seeded from system time
+      and the internal state can be recovered from a few observed values, so an
+      attacker can reconstruct the "random" secret (CWE-330). This is a common
+      AI-generated mistake — `new Random().nextInt(...)` gets pasted in to
+      produce a token because it looks random enough.
+
+      Use `java.security.SecureRandom` instead. For example,
+      `new SecureRandom().nextBytes(buf)` to fill a byte buffer, then encode it
+      (Base64/hex) to build the token or secret.
+    pattern-either:
+      # $VAR = new Random().nextInt(...) / nextLong() / nextDouble() / nextFloat()
+      - patterns:
+          - pattern-either:
+              - pattern: $VAR = new java.util.Random(...).$M(...)
+              - pattern: $VAR = new Random(...).$M(...)
+          - metavariable-regex:
+              metavariable: $VAR
+              regex: (?i).*(token|secret|key|password|passwd|nonce|otp|salt).*
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(nextInt|nextLong|nextDouble|nextFloat|nextBoolean)$
+      # $VAR = Math.random()
+      - patterns:
+          - pattern: $VAR = Math.random()
+          - metavariable-regex:
+              metavariable: $VAR
+              regex: (?i).*(token|secret|key|password|passwd|nonce|otp|salt).*
+      # $RND.nextBytes($BUF) where $RND is a java.util.Random (not SecureRandom)
+      # and the buffer is a secret.
+      - patterns:
+          - pattern-either:
+              - pattern: |
+                  java.util.Random $RND = new java.util.Random(...);
+                  ...
+                  $RND.nextBytes($BUF);
+              - pattern: |
+                  Random $RND = new Random(...);
+                  ...
+                  $RND.nextBytes($BUF);
+          - metavariable-regex:
+              metavariable: $BUF
+              regex: (?i).*(token|secret|key|password|passwd|nonce|otp|salt).*
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CRYPTO-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-crypto-insecure-random
+      category: security
+      cwe: CWE-330
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - java.util
+      references:
+        - https://docs.oracle.com/javase/8/docs/api/java/security/SecureRandom.html
+        - https://cwe.mitre.org/data/definitions/330.html