oauthlint-rules 0.2.3 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/java/crypto/weak-hash.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.java.crypto.weak-hash
+    languages:
+      - java
+    severity: WARNING
+    message: |
+      A broken hash algorithm (MD5 or SHA-1) is being instantiated via JCA
+      `MessageDigest.getInstance(...)`. MD5 and SHA-1 are cryptographically
+      broken: practical collision attacks exist, so they must NOT be used for
+      any security purpose — integrity checks, content/token fingerprints,
+      digital signatures, HMAC keys, or deduplication that a trust decision
+      depends on (CWE-328 / CWE-327).
+
+      Use SHA-256 or stronger (SHA-384, SHA-512, SHA-3):
+      `MessageDigest.getInstance("SHA-256")`. Note: this rule covers the general
+      weak-digest case; storing *passwords* needs a dedicated slow hasher
+      (BCrypt/Argon2/PBKDF2), which is enforced separately.
+    # Match only the algorithm string passed to MessageDigest.getInstance(...).
+    # The metavariable-regex flags the broken digests MD5, SHA-1 and the SHA1
+    # alias (case-insensitive, optional hyphen). It is scoped to the
+    # getInstance(...) instantiation site on purpose so it is low-FP and does
+    # NOT overlap auth.java.crypto.weak-password-hash, which instead anchors on
+    # a password-named digest()/update() call (and also flags SHA-256/SHA-512 in
+    # that password context). "SHA-256"/"SHA-512" are silent here.
+    patterns:
+      - pattern: java.security.MessageDigest.getInstance($ALG, ...)
+      - metavariable-regex:
+          metavariable: $ALG
+          regex: (?i)^"(md5|sha-?1)"$
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CRYPTO-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-crypto-weak-hash
+      category: security
+      cwe: CWE-328
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - java
+      references:
+        - https://cwe.mitre.org/data/definitions/328.html
+        - https://csrc.nist.gov/news/2022/nist-transitioning-away-from-sha-1-for-all-apps

package/rules/oauth/access-token-in-url.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.oauth.access-token-in-url
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      An OAuth `access_token` (or `refresh_token` / `id_token`) is placed in a
+      URL query string. URLs leak: the full URL — token included — is recorded
+      in server and reverse-proxy access logs, saved in browser history, and
+      sent in the `Referer` header to every third-party CDN, analytics, and ad
+      script loaded by the destination page. A token in a URL is a leaked token.
+
+      Send the token in the `Authorization: Bearer …` header, or in a POST
+      request body. Never in the URL query string.
+
+      CWE-598: Use of GET Request Method With Sensitive Query Strings.
+    # Anchored to the query-param shape `?<name>=` / `&<name>=` (the `[?&]…=`
+    # form) so we fire on token-carrying URLs built as string or template
+    # literals, while staying silent on: a token in an `Authorization` header,
+    # a POST body / object property `{ access_token: t }` (no leading `?`/`&`
+    # and no trailing `=`), `params.set('access_token', …)` builders, and the
+    # bare word `access_token` in a comment or non-URL string. Case-insensitive
+    # on the param name. This is deliberately distinct from
+    # auth.flow.credentials-in-url (which excludes `access_token`) and
+    # auth.jwt.in-url (which only matches JWT-shaped `eyJ…` values).
+    pattern-regex: '[?&](?i:access_token|refresh_token|id_token)='
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-013
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-access-token-in-url
+      category: security
+      cwe: CWE-598
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth
+      references:
+        - https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
+        - https://cwe.mitre.org/data/definitions/598.html

package/rules/rust/jwt/no-issuer-validation.yml

@@ -0,0 +1,59 @@
+rules:
+  - id: auth.rust.jwt.no-issuer-validation
+    languages:
+      - rust
+    severity: WARNING
+    message: |
+      A JWT is decoded with a `jsonwebtoken` `Validation` that never sets the
+      expected issuer, so `decode` accepts a token minted by ANY issuer. The
+      `jsonwebtoken` crate does not validate the `iss` claim unless you opt in,
+      so a token signed by an attacker-controlled or otherwise untrusted issuer
+      passes validation as long as the signature checks out. For OAuth/OIDC this
+      lets a token from the wrong authorization server be replayed against this
+      API.
+
+      Pin the issuer before decoding, e.g.
+      `validation.set_issuer(&["https://issuer.example.com"])` (or set
+      `validation.iss`), so only tokens whose `iss` claim matches your trusted
+      authorization server are accepted.
+    # Modeled on auth.rust.jwt.no-aud-validation: detect a `Validation`
+    # (`Validation::new(...)` or `Validation::default()`) that flows into
+    # `decode(...)` but never has its issuer pinned. Unlike `aud`/`exp` (default
+    # `true`, disabled via `validate_* = false`), the issuer check is OFF by
+    # default and must be opted into via `set_issuer(...)` / `validation.iss`,
+    # so the vulnerable shape is the ABSENCE of that call. We bind the validator
+    # to `$V` at construction, require a `decode` that uses it, and suppress the
+    # finding with `pattern-not-inside` when `set_issuer` / `validation.iss` is
+    # set on the same `$V`. Matching on the construction (not the `decode` call)
+    # mirrors the sibling rule's low-FP, AST-only profile.
+    patterns:
+      - pattern-either:
+          - pattern: let mut $V = Validation::new(...);
+          - pattern: let mut $V = Validation::default();
+      - pattern-not-inside: |
+          let mut $V = ...;
+          ...
+          $V.set_issuer(...);
+          ...
+      - pattern-not-inside: |
+          let mut $V = ...;
+          ...
+          $V.iss = $X;
+          ...
+      - pattern-inside: |
+          let mut $V = ...;
+          ...
+          decode($TOKEN, $KEY, &$V)
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-JWT-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-jwt-no-issuer-validation
+      category: security
+      cwe: CWE-345
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - jsonwebtoken
+      references:
+        - https://docs.rs/jsonwebtoken/latest/jsonwebtoken/struct.Validation.html#method.set_issuer
+        - https://cwe.mitre.org/data/definitions/345.html
+        - https://cwe.mitre.org/data/definitions/287.html

package/rules/rust/tls/accept-invalid-certs.yml

@@ -16,6 +16,11 @@ rules:
     # Matches only the literal `true`. `danger_accept_invalid_certs(false)` and
     # the method's absence are not flagged. `$B` is any builder expression.
     pattern: $B.danger_accept_invalid_certs(true)
+    # Safe, deterministic autofix: flip the boolean literal to `false`, which is
+    # the secure default and fully resolves the finding. `$B` (the builder
+    # expression) is preserved verbatim, so the surrounding chain is untouched —
+    # only `true` -> `false` changes.
+    fix: $B.danger_accept_invalid_certs(false)
     metadata:
       oauthlint-rule-id: AUTH-RUST-TLS-001
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-tls-accept-invalid-certs

package/rules/rust/tls/accept-invalid-hostnames.yml

@@ -18,6 +18,11 @@ rules:
     # Matches only the literal `true`. `danger_accept_invalid_hostnames(false)`
     # and the method's absence are not flagged. `$B` is any builder expression.
     pattern: $B.danger_accept_invalid_hostnames(true)
+    # Safe, deterministic autofix: flip the boolean literal to `false`, which is
+    # the secure default and fully resolves the finding. `$B` (the builder
+    # expression) is preserved verbatim, so the surrounding chain is untouched —
+    # only `true` -> `false` changes.
+    fix: $B.danger_accept_invalid_hostnames(false)
     metadata:
       oauthlint-rule-id: AUTH-RUST-TLS-002
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-tls-accept-invalid-hostnames