oauthlint-rules 0.2.5 → 0.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/flow/secret-in-response.yml

@@ -0,0 +1,70 @@
+rules:
+  - id: auth.flow.secret-in-response
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      A server-side secret read from `process.env` flows into an HTTP
+      response body. Whatever you put in `res.send` / `res.json` / `res.end`
+      ships straight to the client, so returning a credential here publishes
+      it to every caller — it ends up in the browser, in proxies, and in any
+      logged response (CWE-200, Sensitive Information Exposure).
+
+      Never send a server secret to the client. Return only the data the
+      caller needs; if the response must reference a credential, send a
+      non-sensitive identifier (a key id, the last four characters) or a
+      redacted/masked value instead. Keep API keys, passwords, tokens, and
+      private keys server-side only.
+    # Reverse-direction taint rule: the SOURCE is the secret (a `process.env.*`
+    # value whose NAME looks like a credential) and the SINK is the Express
+    # response body — the opposite of the request->sink flow rules (ssrf,
+    # open-redirect). Taint mode catches indirection: `const k =
+    # process.env.API_KEY; res.send(k)` flags, not just the inline form.
+    #
+    # Low-FP control is the source NAME regex: it requires a credential-shaped
+    # name AND excludes the client-public prefixes (PUBLIC_, NEXT_PUBLIC_,
+    # VITE_, REACT_APP_, EXPO_PUBLIC_) whose values are exposed to the browser
+    # by design — sending those back is not a leak. Distinct from
+    # auth.secret.public-env-secret, which is a build-time *exposure* check on
+    # the env-var name alone; this rule is a *runtime dataflow* into a response.
+    mode: taint
+    pattern-sources:
+      # process.env.SECRET_NAME — member-access form.
+      - patterns:
+          - pattern: process.env.$KEY
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: (?i)^(?!(?:NEXT_PUBLIC|EXPO_PUBLIC|REACT_APP|PUBLIC|VITE)_).*(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|client[_-]?secret|credential|access[_-]?key).*$
+      # process.env['SECRET_NAME'] — index form.
+      - patterns:
+          - pattern: process.env[$K]
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^(?!(?:NEXT_PUBLIC|EXPO_PUBLIC|REACT_APP|PUBLIC|VITE)_).*(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|client[_-]?secret|credential|access[_-]?key).*$
+    pattern-sanitizers:
+      # Routing the value through a redaction/masking helper clears the taint:
+      # the masked/redacted form is no longer the live secret.
+      - pattern: redact(...)
+      - pattern: mask(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: $RES.send($X)
+              - pattern: $RES.json($X)
+              - pattern: $RES.jsonp($X)
+              - pattern: $RES.end($X)
+              - pattern: $RES.write($X)
+          - focus-metavariable: $X
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-012
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-secret-in-response
+      category: security
+      cwe: CWE-200
+      owasp: API3:2023
+      llm-prevalence: HIGH
+      technology:
+        - express
+      references:
+        - https://cwe.mitre.org/data/definitions/200.html
+        - https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/

package/rules/go/flow/secret-in-response.yml

@@ -0,0 +1,69 @@
+rules:
+  - id: auth.go.flow.secret-in-response
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A server-side secret read from the environment flows into an HTTP
+      response body, leaking it to the client. Values such as an API key,
+      client secret, access key, or private key are meant to stay on the
+      server; writing one to the `http.ResponseWriter` (via `Write`,
+      `fmt.Fprint(f)`, `io.WriteString`, or a JSON encoder) publishes it to
+      every caller — including attackers probing your endpoints.
+
+      Never return a credential to the client. Send only the data the caller
+      legitimately needs; if a secret must appear in a debug/diagnostic path,
+      redact or mask it first. Read secrets exclusively in server-internal
+      code and keep them out of any response payload. See CWE-200.
+    # Reverse-direction taint: the SOURCE is the secret (an os.Getenv /
+    # os.LookupEnv read whose key name looks like a credential) and the SINK is
+    # the HTTP response. Taint mode so indirection (s := os.Getenv("API_KEY");
+    # w.Write([]byte(s))) is caught, not just the inline form. The taint is
+    # cleared by a redaction/mask helper before the value reaches the response.
+    mode: taint
+    pattern-sources:
+      # $KEY is the env-var name literal. The metavariable-regex keeps only
+      # names that look like a credential, while a single negative lookahead
+      # excludes client-public prefixes (PUBLIC_ / NEXT_PUBLIC_) — those ship to
+      # the browser by design and are not server secrets.
+      - patterns:
+          - pattern-either:
+              - pattern: os.Getenv($KEY)
+              - pattern: os.LookupEnv($KEY)
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: (?i)^(?!"?(next_)?public_)"?.*(secret|password|passwd|token|api[_-]?key|private[_-]?key|client[_-]?secret|credential|access[_-]?key).*"?$
+    pattern-sanitizers:
+      # A redaction/mask helper clears the taint: the value written to the
+      # response is no longer the raw secret.
+      - pattern: redact(...)
+      - pattern: mask(...)
+    pattern-sinks:
+      # Focus the value argument so the finding lands on the leaked secret, not
+      # the whole call. Plain-call forms (no aliasing) match reliably in taint
+      # mode. $W is the http.ResponseWriter.
+      - patterns:
+          - pattern-either:
+              - pattern: $W.Write($X)
+              - pattern: fmt.Fprint($W, $X)
+              - pattern: fmt.Fprintf($W, $FMT, $X)
+              - pattern: io.WriteString($W, $X)
+              - pattern: json.NewEncoder($W).Encode($X)
+          # The env-read SOURCE shapes are disjoint from these response sinks,
+          # but exclude them explicitly so an env read is only ever a source,
+          # never re-counted as a sink.
+          - pattern-not: os.Getenv(...)
+          - pattern-not: os.LookupEnv(...)
+          - focus-metavariable: $X
+    metadata:
+      oauthlint-rule-id: AUTH-GO-FLOW-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-flow-secret-in-response
+      category: security
+      cwe: CWE-200
+      owasp: API3:2023
+      llm-prevalence: HIGH
+      technology:
+        - net/http
+      references:
+        - https://cwe.mitre.org/data/definitions/200.html
+        - https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/

package/rules/py/flow/secret-in-response.yml

@@ -0,0 +1,88 @@
+rules:
+  - id: auth.py.flow.secret-in-response
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A server-side secret read from the environment flows into an HTTP
+      response sent back to the client — leaking it (CWE-200). Anything you
+      return from a Flask view (via `jsonify(...)`, `make_response(...)`,
+      `Response(...)`) is visible to every caller, so an env value whose name
+      looks like a credential (`API_KEY`, `CLIENT_SECRET`, `*_TOKEN`,
+      `*_PASSWORD`, a private key, an access key, ...) must never reach it.
+
+      Never send a server secret to the client. Return only the data the
+      caller needs; keep credentials server-side. If a value genuinely must be
+      surfaced, redact or mask it first (`redact(...)` / `mask_secret(...)`),
+      and prefer exposing only public configuration (names prefixed
+      `PUBLIC_` / `NEXT_PUBLIC_` / `VITE_`) to clients.
+    # REVERSE-direction taint: the SOURCE is the secret (an os.environ / getenv
+    # value whose name looks like a credential), the SINK is the HTTP response.
+    # Taint mode so indirection (secret = os.getenv('CLIENT_SECRET');
+    # return jsonify(secret=secret)) is caught, not just the inline form.
+    # `metavariable-regex` constrains the env var NAME to credential-looking
+    # words while excluding public-by-convention prefixes, and passing the value
+    # through a redaction/mask helper clears the taint. The sink focuses the
+    # response value argument. `by-side-effect` is unsupported on semgrep 1.157,
+    # so the source is constrained inline rather than via a propagator.
+    mode: taint
+    pattern-sources:
+      - patterns:
+          - pattern-either:
+              - pattern: os.environ[$KEY]
+              - pattern: os.environ.get($KEY)
+              - pattern: 'os.environ.get($KEY, ...)'
+              - pattern: os.getenv($KEY)
+              - pattern: 'os.getenv($KEY, ...)'
+              # Qualified `from os import environ, getenv` forms.
+              - pattern: environ[$KEY]
+              - pattern: environ.get($KEY)
+              - pattern: 'environ.get($KEY, ...)'
+              - pattern: getenv($KEY)
+              - pattern: 'getenv($KEY, ...)'
+          # $KEY must look like a credential AND must not be a public-by-
+          # convention name. A single regex: a negative lookahead drops the
+          # PUBLIC_/NEXT_PUBLIC_/VITE_ prefixes (so NEXT_PUBLIC_API_KEY is NOT a
+          # source), then a credential keyword must appear. The optional leading
+          # quote tolerates semgrep binding the string literal with or without
+          # its quotes; `(?i)` makes the whole match case-insensitive.
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: '(?i)^[''"]?(?!(?:NEXT_PUBLIC_|VITE_|PUBLIC_))\w*(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|client[_-]?secret|credential|access[_-]?key)'
+    pattern-sanitizers:
+      # Redaction / masking helpers: a secret passed through one of these is no
+      # longer sensitive, so returning the result is safe.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: mask_secret(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              # Flask response constructors — the reliable sinks. Each covers a
+              # positional value and a keyword value (jsonify(secret=...)), and
+              # taint reaching a value nested inside (e.g. a dict) still fires.
+              - pattern: 'jsonify(..., $X, ...)'
+              - pattern: 'jsonify(..., $K=$X, ...)'
+              - pattern: 'flask.jsonify(..., $X, ...)'
+              - pattern: 'flask.jsonify(..., $K=$X, ...)'
+              - pattern: 'make_response(..., $X, ...)'
+              - pattern: 'make_response(..., $K=$X, ...)'
+              - pattern: 'flask.make_response(..., $X, ...)'
+              - pattern: 'flask.make_response(..., $K=$X, ...)'
+              - pattern: 'Response(..., $X, ...)'
+              - pattern: 'Response(..., $K=$X, ...)'
+              - pattern: 'flask.Response(..., $X, ...)'
+              - pattern: 'flask.Response(..., $K=$X, ...)'
+          - focus-metavariable: $X
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLOW-008
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-secret-in-response
+      category: security
+      cwe: CWE-200
+      owasp: API3:2023
+      llm-prevalence: HIGH
+      technology:
+        - flask
+      references:
+        - https://cwe.mitre.org/data/definitions/200.html
+        - https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/

package/rules/py/jwt/algorithm-confusion.yml

@@ -0,0 +1,48 @@
+rules:
+  - id: auth.py.jwt.algorithm-confusion
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A JWT is decoded with an `algorithms` allowlist that mixes a symmetric
+      HMAC algorithm (HS256/HS384/HS512) with an asymmetric one (RS*/ES*/PS*).
+      This enables the "algorithm confusion" attack: an attacker who knows your
+      RSA/EC PUBLIC key can sign a forged token with HMAC, using that public key
+      string as the shared secret. Because HS* is also accepted, PyJWT verifies
+      the forgery with the public key as the HMAC secret and treats it as valid
+      — a complete authentication bypass.
+
+      Allow only ONE algorithm family — the one you actually use. If you issue
+      RS256 tokens, pin `jwt.decode(token, public_key, algorithms=["RS256"])`
+      and never also accept an HS* algorithm with the same verification key.
+
+      CWE-327: Use of a Broken or Risky Cryptographic Algorithm.
+    # Distinct from auth.py.jwt.no-algorithms (which flags a MISSING `algorithms`
+    # allowlist): here the allowlist is PRESENT but dangerously MIXES a symmetric
+    # (HS*) and an asymmetric (RS*/ES*/PS*) family in the same `jwt.decode` call.
+    #
+    # A single metavariable-regex over the bound list literal `$ALGS` requires
+    # BOTH families to appear (order-independent lookaheads), so single-family
+    # lists like ["RS256"] or ["HS256"] never match. `(?s)` lets `.` span a
+    # multi-line list. The `import jwt` guard pins this to PyJWT (joserfc and
+    # other libs expose a different `jwt.decode`).
+    patterns:
+      - pattern: jwt.decode(..., algorithms=$ALGS, ...)
+      - metavariable-regex:
+          metavariable: $ALGS
+          regex: (?s)(?=.*['"]HS(256|384|512)['"])(?=.*['"](RS|ES|PS)(256|384|512)['"])
+      - pattern-inside: |
+          import jwt
+          ...
+    metadata:
+      oauthlint-rule-id: AUTH-PY-JWT-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-jwt-algorithm-confusion
+      category: security
+      cwe: CWE-327
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - PyJWT
+      references:
+        - https://cwe.mitre.org/data/definitions/327.html
+        - https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

package/rules/rust/jwt/algorithm-confusion.yml

@@ -0,0 +1,50 @@
+rules:
+  - id: auth.rust.jwt.algorithm-confusion
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      A `jsonwebtoken` `Validation` accepts a list of algorithms that MIXES an
+      HMAC family (`Algorithm::HS256`/`HS384`/`HS512`) with an asymmetric family
+      (`Algorithm::RS*`/`ES*`/`PS*`). This is the "algorithm confusion" attack:
+      when both families are accepted, an attacker takes your RSA/EC PUBLIC key
+      (which is not secret) and signs a forged token with HS*, using the public
+      key bytes as the HMAC shared secret. `decode` then verifies that forged
+      token as valid, letting the attacker mint arbitrary identities and claims.
+
+      Pin `validation.algorithms` to a SINGLE family you actually use, e.g.
+      `validation.algorithms = vec![Algorithm::RS256];` when your issuer signs
+      with RSA, or `vec![Algorithm::HS256]` for a genuinely symmetric secret.
+      Never accept an HMAC algorithm alongside an asymmetric one.
+
+      CWE-327: use of a broken or risky cryptographic algorithm/configuration.
+    # Algorithm confusion = the accepted-algorithm list mixes an HMAC variant
+    # (HS*) with an asymmetric variant (RS*/ES*/PS*). We bind the algorithm list
+    # expression to $VEC — set either via the public `algorithms` field or via a
+    # `set_algorithms(...)` call — and require, with two ANDed metavariable-regex
+    # constraints, that its source text contains BOTH an `Algorithm::HS*` AND an
+    # `Algorithm::RS*|ES*|PS*` variant. Order-independent (no ellipsis-in-macro
+    # fragility) and inherently low-FP: a single-family list such as
+    # `vec![Algorithm::RS256]` fails the HS* constraint and is never flagged.
+    patterns:
+      - pattern-either:
+          - pattern: $V.algorithms = $VEC;
+          - pattern: $V.set_algorithms($VEC)
+      - metavariable-regex:
+          metavariable: $VEC
+          regex: '(?s).*Algorithm::HS(256|384|512)'
+      - metavariable-regex:
+          metavariable: $VEC
+          regex: '(?s).*Algorithm::(RS|ES|PS)(256|384|512)'
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-JWT-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-jwt-algorithm-confusion
+      category: security
+      cwe: CWE-327
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - jsonwebtoken
+      references:
+        - https://cwe.mitre.org/data/definitions/327.html
+        - https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/