oauthlint-rules 0.2.0 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/cors/reflect-origin.yml

@@ -43,16 +43,26 @@ rules:
       # express cors() middleware: a callback that unconditionally allows
       # every origin (cb(null, true) regardless of the origin argument).
       - pattern: 'cors({ ..., origin: ($O, $CB) => $CB(null, true), ... })'
+      # A block-body callback that returns `cb(null, true)` is only dangerous
+      # when it does so UNCONDITIONALLY — i.e. it ignores its origin argument.
+      # A callback that inspects `$O` inside an `if` (e.g. `if (allow.has(origin))
+      # return cb(null, true)`) is the allowlist pattern this rule recommends, so
+      # the `pattern-not` below suppresses it. Without that guard the rule flagged
+      # the exact safe shape its own message tells you to use.
       - patterns:
           - pattern: |
               cors({ ..., origin: ($O, $CB) => { ... }, ... })
           - pattern-inside: |
               cors({ ..., origin: ($O, $CB) => { ... return $CB(null, true); }, ... })
+          - pattern-not: |
+              cors({ ..., origin: ($O, $CB) => { ... if (<... $O ...>) { ... } ... }, ... })
       - patterns:
           - pattern: |
               cors({ ..., origin: function ($O, $CB) { ... }, ... })
           - pattern-inside: |
               cors({ ..., origin: function ($O, $CB) { ... return $CB(null, true); }, ... })
+          - pattern-not: |
+              cors({ ..., origin: function ($O, $CB) { ... if (<... $O ...>) { ... } ... }, ... })
     metadata:
       oauthlint-rule-id: AUTH-CORS-002
       oauthlint-doc-url: https://oauthlint.dev/rules/cors-reflect-origin

package/rules/jwt/localstorage.yml

@@ -21,10 +21,22 @@ rules:
     # NOT match the bare words `auth`/`access`/`refresh`/`session` because they
     # appear as substrings of innocuous keys (author_filter, auto_refresh,
     # access_count, sidebar_session) and produced false positives.
+    # A write to web storage (`setItem(k, v)` or `store[k] = v`) is flagged when
+    # EITHER the key is a token-named string literal OR the value is a token-named
+    # identifier. The latter catches `localStorage.setItem(TOKEN_KEY, token)`,
+    # where the key is a variable — the most common real-world shape. We match
+    # only the strong words `token`/`jwt`/`bearer`/`credential`/`api_key` (never
+    # bare `auth`/`access`/`refresh`/`session`, which appear in innocuous keys
+    # like `author_filter`, `auto_refresh`, `access_count`).
     pattern-either:
+      # `setItem(key, value)` where a strong token word appears in EITHER the key
+      # or the value. Matching the whole call as one range (rather than separate
+      # key/value patterns) catches `setItem(TOKEN_KEY, token)` — the common shape
+      # where the key is a variable — without double-counting literal-key lines.
       - patterns:
           - pattern-regex: |-
-              (?:window\.|globalThis\.|self\.)?(?:localStorage|sessionStorage)\.setItem\(\s*['"][^'"]*(?i:token|jwt|bearer|credential|api[_-]?key)[^'"]*['"]
+              (?:window\.|globalThis\.|self\.)?(?:localStorage|sessionStorage)\.setItem\([^)]*?(?i:token|jwt|bearer|credential|api[_-]?key)
+      # Bracket assignment with a token-named string-literal key.
       - patterns:
           - pattern-regex: |-
               (?:window\.|globalThis\.|self\.)?(?:localStorage|sessionStorage)\[\s*['"][^'"]*(?i:token|jwt|bearer|credential|api[_-]?key)[^'"]*['"]\s*\]\s*=

package/rules/oauth/no-state-validation.yml

@@ -13,24 +13,46 @@ rules:
       Compare the received `state` to the value you stored before
       redirecting (session, signed cookie, or Redis). Reject the callback
       if it's missing or doesn't match.
-    # Suppress when the received `state` is referenced inside ANY `if`
-    # condition — that's the validation. The deep-expression operator
-    # `<... state ...>` makes this order-agnostic and helper-aware, so
-    # `if (req.query.state !== stored)`, `if (stored === req.query.state)`, and
-    # `if (!verifyState(req.query.state))` are all treated as safe (the previous
-    # exact-shape patterns only matched one operand order → false positives).
+    # Suppress when the received `state` is validated. Two shapes count as
+    # validation:
+    #   1. The read appears directly inside an `if` condition, e.g.
+    #      `if (req.query.state !== stored)`. The deep-expression operator
+    #      `<... state ...>` makes this order-agnostic and helper-aware, so
+    #      `if (stored === req.query.state)` and `if (!verifyState(req.query.state))`
+    #      are all safe (the previous exact-shape patterns only matched one
+    #      operand order → false positives).
+    #   2. The read is captured into a variable that is later compared, e.g.
+    #      `const state = url.searchParams.get("state"); ...; if (state !== stored)`.
+    #      This is the most common real-world shape (the callback reads state
+    #      once, then validates the local) and the inline-`if` suppressors alone
+    #      miss it. The sequence patterns below match the read assigned to `$S`
+    #      followed (after any statements) by an `if` that references `$S`.
     pattern-either:
       - patterns:
           - pattern-either:
               - pattern: '$REQ.query.state'
               - pattern: '$REQ.body.state'
               - pattern: '$URL.searchParams.get("state")'
+          # (1) read used directly inside an `if` condition
           - pattern-not-inside: |
               if (<... $REQ.query.state ...>) { ... }
           - pattern-not-inside: |
               if (<... $REQ.body.state ...>) { ... }
           - pattern-not-inside: |
               if (<... $URL.searchParams.get("state") ...>) { ... }
+          # (2) read captured into a local that is later validated in an `if`
+          - pattern-not-inside: |
+              $S = $REQ.query.state;
+              ...
+              if (<... $S ...>) { ... }
+          - pattern-not-inside: |
+              $S = $REQ.body.state;
+              ...
+              if (<... $S ...>) { ... }
+          - pattern-not-inside: |
+              $S = $URL.searchParams.get("state");
+              ...
+              if (<... $S ...>) { ... }
     metadata:
       oauthlint-rule-id: AUTH-OAUTH-007
       oauthlint-doc-url: https://oauthlint.dev/rules/oauth-no-state-validation