oauthlint-rules 0.2.3 → 0.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/flow/open-redirect.yml

@@ -0,0 +1,76 @@
+rules:
+  - id: auth.flow.open-redirect
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      Untrusted request input flows into a redirect destination. Because the
+      target URL is attacker-controlled, this is an open redirect (CWE-601):
+      an attacker can craft a link to your trusted host that bounces the victim
+      to an arbitrary external site. That fuels phishing, and in OAuth flows it
+      can be chained to steal authorization codes or access tokens by sending
+      the victim (and their callback) to a server you do not control.
+
+      Never redirect to a raw `req.query` / `req.body` / `req.params` /
+      `req.cookies` / `req.headers` value. Validate the destination against an
+      explicit allow-list of hosts or route names, or only allow relative paths
+      you control (reject anything containing a scheme or `//`).
+    # Taint mode so indirection is caught — `const dest = req.body.url;
+    # res.redirect(dest)` flags, not just the direct `res.redirect(req.query.x)`
+    # form. Passing the value through an allow-list / validation call
+    # (isAllowedUrl, allowlist.includes, Set.has) clears the taint, so a
+    # genuinely validated redirect does not fire.
+    mode: taint
+    pattern-sources:
+      - pattern: $REQ.query
+      - pattern: $REQ.params
+      - pattern: $REQ.body
+      - pattern: $REQ.cookies
+      - pattern: $REQ.headers
+      - pattern: $REQ.query.$X
+      - pattern: $REQ.params.$X
+      - pattern: $REQ.body.$X
+      - pattern: $REQ.cookies.$X
+      - pattern: $REQ.headers.$X
+      - pattern: $REQ.query[$K]
+      - pattern: $REQ.params[$K]
+      - pattern: $REQ.body[$K]
+      - pattern: $REQ.cookies[$K]
+      - pattern: $REQ.headers[$K]
+    pattern-sanitizers:
+      # Routing the value through an allow-list / validation helper clears the
+      # taint: only the vetted result (not the raw request input) reaches the
+      # sink. Matched by a conventional validation-helper call, or by an
+      # allow-list membership test (`Set.has` / `Array.includes`) that the
+      # value is passed through.
+      - pattern: isAllowedUrl(...)
+      - pattern: validateRedirect(...)
+      - pattern: sanitizeRedirect(...)
+      - pattern: $ALLOW.includes(...)
+      - pattern: $ALLOW.has(...)
+      - pattern: $ALLOW.indexOf(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: $RES.redirect($SINK)
+              - pattern: $RES.redirect($CODE, $SINK)
+              - pattern: $RES.location($SINK)
+              - pattern: "$RES.set('Location', $SINK)"
+              - pattern: '$RES.set("Location", $SINK)'
+              - pattern: "$RES.setHeader('Location', $SINK)"
+              - pattern: '$RES.setHeader("Location", $SINK)'
+              - pattern: "$RES.writeHead($S, {..., Location: $SINK, ...})"
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-010
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-open-redirect
+      category: security
+      cwe: CWE-601
+      owasp: A01:2021
+      llm-prevalence: HIGH
+      technology:
+        - express
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/601.html

package/rules/flow/ssrf.yml

@@ -0,0 +1,85 @@
+rules:
+  - id: auth.flow.ssrf
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the URL of an outbound HTTP request.
+      Because the destination is attacker-controlled, this is a Server-Side
+      Request Forgery (CWE-918): an attacker can point the request at internal
+      services behind your firewall, or at the cloud metadata endpoint
+      (http://169.254.169.254/...) to steal IAM/instance credentials and pivot
+      deeper into your infrastructure.
+
+      Never build a request URL straight from a raw `req.query` / `req.body` /
+      `req.params` / `req.cookies` / `req.headers` value. Validate the
+      destination against an explicit allow-list of hosts (resolve the URL and
+      check its host against the allow-list, rejecting private/loopback ranges)
+      before issuing the request.
+    # Taint mode so indirection is caught — `const u = req.query.endpoint;
+    # http.get(u)` flags, not just the direct `fetch(req.query.url)` form.
+    # Passing the value through a host allow-list / validation call
+    # (isAllowedUrl, allowlist.includes, Set.has) clears the taint, so a
+    # genuinely vetted outbound request does not fire.
+    mode: taint
+    pattern-sources:
+      - pattern: $REQ.query
+      - pattern: $REQ.params
+      - pattern: $REQ.body
+      - pattern: $REQ.cookies
+      - pattern: $REQ.headers
+      - pattern: $REQ.query.$X
+      - pattern: $REQ.params.$X
+      - pattern: $REQ.body.$X
+      - pattern: $REQ.cookies.$X
+      - pattern: $REQ.headers.$X
+      - pattern: $REQ.query[$K]
+      - pattern: $REQ.params[$K]
+      - pattern: $REQ.body[$K]
+      - pattern: $REQ.cookies[$K]
+      - pattern: $REQ.headers[$K]
+    pattern-sanitizers:
+      # Routing the value through a host allow-list / validation helper clears
+      # the taint: only the vetted destination (not the raw request input)
+      # reaches the request. Matched by a conventional validation-helper call,
+      # or by an allow-list membership test (`Set.has` / `Array.includes`) that
+      # the value is passed through.
+      - pattern: isAllowedUrl(...)
+      - pattern: validateUrl(...)
+      - pattern: assertAllowedHost(...)
+      - pattern: $ALLOW.includes(...)
+      - pattern: $ALLOW.has(...)
+      - pattern: $ALLOW.indexOf(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: fetch($SINK, ...)
+              - pattern: nodeFetch($SINK, ...)
+              - pattern: request($SINK, ...)
+              - pattern: got($SINK, ...)
+              - pattern: axios($SINK)
+              - pattern: axios.get($SINK, ...)
+              - pattern: axios.post($SINK, ...)
+              - pattern: axios.put($SINK, ...)
+              - pattern: axios.delete($SINK, ...)
+              - pattern: "axios.request({..., url: $SINK, ...})"
+              - pattern: http.get($SINK, ...)
+              - pattern: https.get($SINK, ...)
+              - pattern: http.request($SINK, ...)
+              - pattern: https.request($SINK, ...)
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-011
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-ssrf
+      category: security
+      cwe: CWE-918
+      owasp: API7:2023
+      llm-prevalence: HIGH
+      technology:
+        - express
+        - axios
+        - fetch
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/918.html

package/rules/go/flow/open-redirect.yml

@@ -0,0 +1,58 @@
+rules:
+  - id: auth.go.flow.open-redirect
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      Untrusted request data flows into an HTTP redirect destination. An
+      attacker who controls the redirect target (via a query parameter, form
+      field, or request header) can forward the victim to an arbitrary
+      external site while the link still appears to point at your trusted
+      domain — a classic open redirect, commonly abused to bypass OAuth
+      `redirect_uri` checks and to mount convincing phishing.
+
+      Do not pass request-derived values straight into `http.Redirect(...)`
+      or a `Location` header. Validate the destination against an explicit
+      allow-list, or restrict it to a known relative path (reject absolute
+      URLs, scheme-relative `//host` values, and back-references) before
+      redirecting. See CWE-601.
+    # Taint mode so indirection (dest := r.FormValue("url"); http.Redirect(w,
+    # r, dest, ...)) is caught, not just the inline form. The taint is cleared
+    # by an allow-list / validation helper that vets the destination, or by a
+    # url.Parse(...)-then-checked flow where the parsed value is inspected
+    # before use.
+    mode: taint
+    pattern-sources:
+      # $R is the *http.Request. Cover the common net/http input shapes.
+      - pattern: $R.URL.Query().Get(...)
+      - pattern: $R.URL.Query()
+      - pattern: $R.URL.Query()[$K]
+      - pattern: $R.FormValue(...)
+      - pattern: $R.PostFormValue(...)
+      - pattern: $R.Header.Get(...)
+    pattern-sanitizers:
+      # Allow-list / validation helper that vets the destination string.
+      - pattern: validateRedirect(...)
+      - pattern: isAllowedRedirect(...)
+      - pattern: $ALLOW.MatchString(...)
+      # url.Parse-then-checked: a parsed URL that has been inspected is treated
+      # as cleared (the result is rebuilt/validated rather than reflected raw).
+      - pattern: url.Parse(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: http.Redirect($W, $R, $DEST, $CODE)
+              - pattern: $W.Header().Set("Location", $DEST)
+          - focus-metavariable: $DEST
+    metadata:
+      oauthlint-rule-id: AUTH-GO-FLOW-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-flow-open-redirect
+      category: security
+      cwe: CWE-601
+      owasp: A01:2021
+      llm-prevalence: HIGH
+      technology:
+        - net/http
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/601.html

package/rules/go/flow/ssrf.yml

@@ -0,0 +1,76 @@
+rules:
+  - id: auth.go.flow.ssrf
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      Untrusted request data flows into the URL of an outbound HTTP request.
+      An attacker who controls the request target (via a query parameter, form
+      field, or request header) can coerce your server into making requests to
+      arbitrary destinations — Server-Side Request Forgery (SSRF). This is
+      routinely abused to reach internal-only services behind your network
+      perimeter and, most damagingly, the cloud instance metadata endpoint
+      (e.g. http://169.254.169.254/...), letting an attacker steal short-lived
+      credentials and pivot into your cloud account.
+
+      Never pass a request-derived value straight into `http.Get`,
+      `http.Post`, `http.NewRequest`, or a client's `Get`/`Post`. Validate the
+      destination host against an explicit allow-list (parse the URL and check
+      the resolved host/scheme), and reject requests to private, loopback, and
+      link-local address ranges before dialing. See CWE-918.
+    # Taint mode so indirection (target := r.FormValue("endpoint");
+    # http.Get(target)) is caught, not just the inline form. The taint is
+    # cleared by an allow-list / host-validation helper, or by a
+    # url.Parse(...)-then-checked flow where the parsed host is vetted before
+    # the request is made.
+    mode: taint
+    pattern-sources:
+      # $R is the *http.Request. Cover the common net/http input shapes.
+      - pattern: $R.URL.Query().Get(...)
+      - pattern: $R.URL.Query()
+      - pattern: $R.URL.Query()[$K]
+      - pattern: $R.FormValue(...)
+      - pattern: $R.PostFormValue(...)
+      - pattern: $R.Header.Get(...)
+    pattern-sanitizers:
+      # Allow-list / host-validation helper that vets the URL string.
+      - pattern: validateURL(...)
+      - pattern: isAllowedHost(...)
+      - pattern: $ALLOW.MatchString(...)
+      # url.Parse-then-checked: a parsed URL whose host has been inspected is
+      # treated as cleared (the request is built from a vetted destination
+      # rather than the raw untrusted string).
+      - pattern: url.Parse(...)
+    pattern-sinks:
+      # Focus the URL argument so the finding lands on the tainted destination,
+      # not the whole call. The plain call form is used (no aliasing) because
+      # it matches reliably in taint mode.
+      - patterns:
+          - pattern-either:
+              - pattern: http.Get($URL)
+              - pattern: http.Post($URL, ...)
+              - pattern: http.Head($URL)
+              - pattern: http.NewRequest($M, $URL, ...)
+              - pattern: http.NewRequestWithContext($CTX, $M, $URL, ...)
+              - pattern: $CLIENT.Get($URL)
+              - pattern: $CLIENT.Post($URL, ...)
+          # The bare `$CLIENT.Get(...)` shape collides with the request-input
+          # SOURCES that are themselves `.Get(...)` calls (`r.URL.Query().Get(...)`
+          # and `r.Header.Get(...)`), which over-matched the source-assignment
+          # line. Exclude those accessors so each is only ever a source, leaving
+          # `client.Get(url)` as the genuine outbound-request sink.
+          - pattern-not: $Q.Query().Get(...)
+          - pattern-not: $H.Header.Get(...)
+          - focus-metavariable: $URL
+    metadata:
+      oauthlint-rule-id: AUTH-GO-FLOW-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-flow-ssrf
+      category: security
+      cwe: CWE-918
+      owasp: API7:2023
+      llm-prevalence: HIGH
+      technology:
+        - net/http
+      references:
+        - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
+        - https://cwe.mitre.org/data/definitions/918.html

package/rules/java/crypto/weak-hash.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.java.crypto.weak-hash
+    languages:
+      - java
+    severity: WARNING
+    message: |
+      A broken hash algorithm (MD5 or SHA-1) is being instantiated via JCA
+      `MessageDigest.getInstance(...)`. MD5 and SHA-1 are cryptographically
+      broken: practical collision attacks exist, so they must NOT be used for
+      any security purpose — integrity checks, content/token fingerprints,
+      digital signatures, HMAC keys, or deduplication that a trust decision
+      depends on (CWE-328 / CWE-327).
+
+      Use SHA-256 or stronger (SHA-384, SHA-512, SHA-3):
+      `MessageDigest.getInstance("SHA-256")`. Note: this rule covers the general
+      weak-digest case; storing *passwords* needs a dedicated slow hasher
+      (BCrypt/Argon2/PBKDF2), which is enforced separately.
+    # Match only the algorithm string passed to MessageDigest.getInstance(...).
+    # The metavariable-regex flags the broken digests MD5, SHA-1 and the SHA1
+    # alias (case-insensitive, optional hyphen). It is scoped to the
+    # getInstance(...) instantiation site on purpose so it is low-FP and does
+    # NOT overlap auth.java.crypto.weak-password-hash, which instead anchors on
+    # a password-named digest()/update() call (and also flags SHA-256/SHA-512 in
+    # that password context). "SHA-256"/"SHA-512" are silent here.
+    patterns:
+      - pattern: java.security.MessageDigest.getInstance($ALG, ...)
+      - metavariable-regex:
+          metavariable: $ALG
+          regex: (?i)^"(md5|sha-?1)"$
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CRYPTO-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-crypto-weak-hash
+      category: security
+      cwe: CWE-328
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - java
+      references:
+        - https://cwe.mitre.org/data/definitions/328.html
+        - https://csrc.nist.gov/news/2022/nist-transitioning-away-from-sha-1-for-all-apps

package/rules/oauth/access-token-in-url.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.oauth.access-token-in-url
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      An OAuth `access_token` (or `refresh_token` / `id_token`) is placed in a
+      URL query string. URLs leak: the full URL — token included — is recorded
+      in server and reverse-proxy access logs, saved in browser history, and
+      sent in the `Referer` header to every third-party CDN, analytics, and ad
+      script loaded by the destination page. A token in a URL is a leaked token.
+
+      Send the token in the `Authorization: Bearer …` header, or in a POST
+      request body. Never in the URL query string.
+
+      CWE-598: Use of GET Request Method With Sensitive Query Strings.
+    # Anchored to the query-param shape `?<name>=` / `&<name>=` (the `[?&]…=`
+    # form) so we fire on token-carrying URLs built as string or template
+    # literals, while staying silent on: a token in an `Authorization` header,
+    # a POST body / object property `{ access_token: t }` (no leading `?`/`&`
+    # and no trailing `=`), `params.set('access_token', …)` builders, and the
+    # bare word `access_token` in a comment or non-URL string. Case-insensitive
+    # on the param name. This is deliberately distinct from
+    # auth.flow.credentials-in-url (which excludes `access_token`) and
+    # auth.jwt.in-url (which only matches JWT-shaped `eyJ…` values).
+    pattern-regex: '[?&](?i:access_token|refresh_token|id_token)='
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-013
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-access-token-in-url
+      category: security
+      cwe: CWE-598
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth
+      references:
+        - https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
+        - https://cwe.mitre.org/data/definitions/598.html

package/rules/py/flow/open-redirect.yml

@@ -0,0 +1,82 @@
+rules:
+  - id: auth.py.flow.open-redirect
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      Untrusted request data flows into a Flask `redirect(...)` without
+      validation — an open redirect (CWE-601). An attacker can craft a link
+      to your trusted domain that bounces the victim to an attacker-controlled
+      site, enabling phishing and OAuth redirect/authorization-code abuse (the
+      victim trusts your URL, then lands on the attacker's page).
+
+      Never redirect to a raw `request.args`/`request.form`/`request.values`/
+      `request.cookies`/`request.headers` value. Build the destination with
+      `url_for(...)` (safe by construction), or validate the target against an
+      explicit allow-list / an `is_safe_url(...)`-style same-host check before
+      redirecting.
+    # Taint mode so indirection (dest = request.args['url']; return redirect(dest))
+    # and `.get(...)` accessors are caught, not just the direct form. Passing the
+    # value through url_for(...) or an is_safe_url(...)/allow-list check clears the
+    # taint. The sink focuses the redirect target argument (and a Location header).
+    mode: taint
+    pattern-sources:
+      - pattern: flask.request.args
+      - pattern: flask.request.form
+      - pattern: flask.request.values
+      - pattern: flask.request.cookies
+      - pattern: flask.request.headers
+      - pattern: request.args
+      - pattern: request.form
+      - pattern: request.values
+      - pattern: request.cookies
+      - pattern: request.headers
+      - pattern: request.args.get(...)
+      - pattern: request.form.get(...)
+      - pattern: request.values.get(...)
+      - pattern: request.cookies.get(...)
+      - pattern: request.headers.get(...)
+      - pattern: request.args[$K]
+      - pattern: request.form[$K]
+      - pattern: request.values[$K]
+      - pattern: request.cookies[$K]
+      - pattern: request.headers[$K]
+    pattern-sanitizers:
+      # `url_for(...)` builds the URL from a known endpoint — safe by construction.
+      - pattern: url_for(...)
+      - pattern: flask.url_for(...)
+      # Allow-list / same-host validators used as a guard:
+      #   if is_safe_url(target): return redirect(target)
+      # A value used inside such an `if` body is treated as validated, so the
+      # guarded redirect does not fire.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if is_safe_url($V):
+                  ...
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if url_has_allowed_host_and_scheme($V, ...):
+                  ...
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: redirect($SINK)
+              - pattern: redirect($SINK, ...)
+              - pattern: flask.redirect($SINK)
+              - pattern: flask.redirect($SINK, ...)
+              - pattern: 'Response(..., headers={..., "Location": $SINK, ...}, ...)'
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLOW-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-open-redirect
+      category: security
+      cwe: CWE-601
+      owasp: A01:2021
+      llm-prevalence: HIGH
+      technology:
+        - flask
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/601.html

package/rules/py/flow/ssrf.yml

@@ -0,0 +1,118 @@
+rules:
+  - id: auth.py.flow.ssrf
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      Untrusted request data flows into an outbound HTTP request without
+      validation — a Server-Side Request Forgery (SSRF, CWE-918). An attacker
+      who controls the target URL can make your server reach internal-only
+      services (admin panels, databases, other microservices behind your
+      firewall) or the cloud metadata endpoint (e.g. http://169.254.169.254/),
+      stealing IAM/instance credentials and pivoting deeper into your network.
+
+      Never pass a raw `request.args`/`request.form`/`request.values`/
+      `request.json`/`request.cookies`/`request.headers` value to
+      `requests`/`urllib`/`httpx`/`aiohttp`. Validate the destination host
+      against an explicit allow-list (`is_allowed_url(...)` /
+      `validate_host(...)` / `url_has_allowed_host_and_scheme(...)`) before the
+      request, and reject link-local / private / metadata addresses.
+    # Taint mode so indirection (url = request.json['endpoint']; httpx.get(url))
+    # and `.get(...)` accessors are caught, not just the direct form. Passing the
+    # value through an allow-list / host validator clears the taint. The sink
+    # focuses the URL argument of each HTTP client call.
+    mode: taint
+    pattern-sources:
+      - pattern: flask.request.args
+      - pattern: flask.request.form
+      - pattern: flask.request.values
+      - pattern: flask.request.json
+      - pattern: flask.request.cookies
+      - pattern: flask.request.headers
+      - pattern: request.args
+      - pattern: request.form
+      - pattern: request.values
+      - pattern: request.json
+      - pattern: request.cookies
+      - pattern: request.headers
+      - pattern: request.args.get(...)
+      - pattern: request.form.get(...)
+      - pattern: request.values.get(...)
+      - pattern: request.json.get(...)
+      - pattern: request.cookies.get(...)
+      - pattern: request.headers.get(...)
+      - pattern: request.args[$K]
+      - pattern: request.form[$K]
+      - pattern: request.values[$K]
+      - pattern: request.json[$K]
+      - pattern: request.cookies[$K]
+      - pattern: request.headers[$K]
+    pattern-sanitizers:
+      # Allow-list / host validators used as a guard:
+      #   if is_allowed_url(url): requests.get(url)
+      # A value used inside such an `if` body is treated as validated, so the
+      # guarded request does not fire. `by-side-effect` is unsupported on
+      # semgrep 1.157, so we use the `pattern-inside` if-guard approach.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if is_allowed_url($V):
+                  ...
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if validate_host($V):
+                  ...
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if url_has_allowed_host_and_scheme($V, ...):
+                  ...
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: 'requests.get($URL, ...)'
+              - pattern: 'requests.post($URL, ...)'
+              - pattern: 'requests.put($URL, ...)'
+              - pattern: 'requests.delete($URL, ...)'
+              - pattern: 'requests.patch($URL, ...)'
+              - pattern: 'requests.head($URL, ...)'
+              - pattern: 'requests.request(..., $URL, ...)'
+              - pattern: 'urllib.request.urlopen($URL, ...)'
+              - pattern: urllib.request.urlopen($URL)
+              - pattern: 'httpx.get($URL, ...)'
+              - pattern: 'httpx.post($URL, ...)'
+              - pattern: 'httpx.put($URL, ...)'
+              - pattern: 'httpx.delete($URL, ...)'
+              - pattern: 'httpx.patch($URL, ...)'
+              - pattern: 'httpx.head($URL, ...)'
+              # httpx.Client()/aiohttp session calls. Excluding a `request`
+              # receiver keeps these from matching the `request.X.get(...)`
+              # SOURCE accessors (which would otherwise self-report).
+              - patterns:
+                  - pattern-either:
+                      - pattern: '$CLIENT.get($URL, ...)'
+                      - pattern: '$CLIENT.post($URL, ...)'
+                      - pattern: '$CLIENT.put($URL, ...)'
+                      - pattern: '$CLIENT.delete($URL, ...)'
+                      - pattern: '$CLIENT.patch($URL, ...)'
+                      - pattern: '$CLIENT.head($URL, ...)'
+                      - pattern: '$CLIENT.request(..., $URL, ...)'
+                  - metavariable-regex:
+                      metavariable: $CLIENT
+                      regex: '^(?!request(\.|$)).*'
+          - focus-metavariable: $URL
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLOW-007
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-ssrf
+      category: security
+      cwe: CWE-918
+      owasp: API7:2023
+      llm-prevalence: HIGH
+      technology:
+        - flask
+        - requests
+        - httpx
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/918.html

package/rules/rust/jwt/no-issuer-validation.yml

@@ -0,0 +1,59 @@
+rules:
+  - id: auth.rust.jwt.no-issuer-validation
+    languages:
+      - rust
+    severity: WARNING
+    message: |
+      A JWT is decoded with a `jsonwebtoken` `Validation` that never sets the
+      expected issuer, so `decode` accepts a token minted by ANY issuer. The
+      `jsonwebtoken` crate does not validate the `iss` claim unless you opt in,
+      so a token signed by an attacker-controlled or otherwise untrusted issuer
+      passes validation as long as the signature checks out. For OAuth/OIDC this
+      lets a token from the wrong authorization server be replayed against this
+      API.
+
+      Pin the issuer before decoding, e.g.
+      `validation.set_issuer(&["https://issuer.example.com"])` (or set
+      `validation.iss`), so only tokens whose `iss` claim matches your trusted
+      authorization server are accepted.
+    # Modeled on auth.rust.jwt.no-aud-validation: detect a `Validation`
+    # (`Validation::new(...)` or `Validation::default()`) that flows into
+    # `decode(...)` but never has its issuer pinned. Unlike `aud`/`exp` (default
+    # `true`, disabled via `validate_* = false`), the issuer check is OFF by
+    # default and must be opted into via `set_issuer(...)` / `validation.iss`,
+    # so the vulnerable shape is the ABSENCE of that call. We bind the validator
+    # to `$V` at construction, require a `decode` that uses it, and suppress the
+    # finding with `pattern-not-inside` when `set_issuer` / `validation.iss` is
+    # set on the same `$V`. Matching on the construction (not the `decode` call)
+    # mirrors the sibling rule's low-FP, AST-only profile.
+    patterns:
+      - pattern-either:
+          - pattern: let mut $V = Validation::new(...);
+          - pattern: let mut $V = Validation::default();
+      - pattern-not-inside: |
+          let mut $V = ...;
+          ...
+          $V.set_issuer(...);
+          ...
+      - pattern-not-inside: |
+          let mut $V = ...;
+          ...
+          $V.iss = $X;
+          ...
+      - pattern-inside: |
+          let mut $V = ...;
+          ...
+          decode($TOKEN, $KEY, &$V)
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-JWT-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-jwt-no-issuer-validation
+      category: security
+      cwe: CWE-345
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - jsonwebtoken
+      references:
+        - https://docs.rs/jsonwebtoken/latest/jsonwebtoken/struct.Validation.html#method.set_issuer
+        - https://cwe.mitre.org/data/definitions/345.html
+        - https://cwe.mitre.org/data/definitions/287.html

package/rules/rust/tls/accept-invalid-certs.yml

@@ -16,6 +16,11 @@ rules:
     # Matches only the literal `true`. `danger_accept_invalid_certs(false)` and
     # the method's absence are not flagged. `$B` is any builder expression.
     pattern: $B.danger_accept_invalid_certs(true)
+    # Safe, deterministic autofix: flip the boolean literal to `false`, which is
+    # the secure default and fully resolves the finding. `$B` (the builder
+    # expression) is preserved verbatim, so the surrounding chain is untouched —
+    # only `true` -> `false` changes.
+    fix: $B.danger_accept_invalid_certs(false)
     metadata:
       oauthlint-rule-id: AUTH-RUST-TLS-001
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-tls-accept-invalid-certs

package/rules/rust/tls/accept-invalid-hostnames.yml

@@ -18,6 +18,11 @@ rules:
     # Matches only the literal `true`. `danger_accept_invalid_hostnames(false)`
     # and the method's absence are not flagged. `$B` is any builder expression.
     pattern: $B.danger_accept_invalid_hostnames(true)
+    # Safe, deterministic autofix: flip the boolean literal to `false`, which is
+    # the secure default and fully resolves the finding. `$B` (the builder
+    # expression) is preserved verbatim, so the surrounding chain is untouched —
+    # only `true` -> `false` changes.
+    fix: $B.danger_accept_invalid_hostnames(false)
     metadata:
       oauthlint-rule-id: AUTH-RUST-TLS-002
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-tls-accept-invalid-hostnames