oauthlint-rules 0.2.5 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.2.5",
+  "version": "0.3.0",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/cookie/no-httponly.yml

@@ -39,7 +39,11 @@ rules:
           - metavariable-regex:
               metavariable: $NAME
               regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
-    fix: '$RES.cookie($NAME, $VAL, { ...$OPTS, httpOnly: true })'
+    # No autofix. As with `auth.cookie.no-secure`, a single rule-level `fix:`
+    # cannot cover all three matched shapes safely: a spread template corrupts
+    # the 2-arg form (unbound `$OPTS` is emitted literally) and does not resolve
+    # an explicit `httpOnly: false`. Inserting a missing key is not a clean
+    # literal replacement, so this rule deliberately ships no `fix:`.
     metadata:
       oauthlint-rule-id: AUTH-COOKIE-002
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-httponly

package/rules/cookie/no-samesite.yml

@@ -41,7 +41,11 @@ rules:
                     - pattern: "{..., sameSite: 'None', ...}"
                     - pattern: '{..., sameSite: "None", ...}'
                 - pattern-not: '{..., secure: true, ...}'
-    fix: "$RES.cookie($NAME, $VAL, { ...$OPTS, sameSite: 'strict' })"
+    # No autofix. The correct `SameSite` value is context-dependent — `Strict`
+    # suits most auth flows but breaks OAuth callbacks, which need `Lax`, while a
+    # cookie deliberately set cross-site needs `None` plus `Secure`. The tool
+    # cannot know which, and a spread template would also corrupt the 2-arg form
+    # (unbound `$OPTS`). So this rule deliberately ships no `fix:`.
     metadata:
       oauthlint-rule-id: AUTH-COOKIE-003
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-samesite

package/rules/cookie/no-secure.yml

@@ -39,11 +39,14 @@ rules:
           - metavariable-regex:
               metavariable: $NAME
               regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
-    # Auto-fix applies to the first (3-arg) pattern: spread the existing
-    # options object and inject secure:true. Verbose but always-correct;
-    # users can run prettier afterwards. The 2-arg branch is left alone
-    # because rewriting it requires inserting a brand-new argument.
-    fix: '$RES.cookie($NAME, $VAL, { ...$OPTS, secure: true })'
+    # No autofix. A single rule-level `fix:` cannot be made safe here: this rule
+    # matches three shapes — an options object missing `secure`, the 2-arg form
+    # with no options object at all, and an explicit `secure: false`. A spread
+    # template like `{ ...$OPTS, secure: true }` corrupts the 2-arg form (`$OPTS`
+    # is unbound, so Semgrep emits the literal text `$OPTS`) and leaves an
+    # explicit `secure: false` key in place (the finding re-fires). Inserting a
+    # brand-new argument/key is not a clean literal replacement, so we ship no
+    # `fix:` rather than a rewrite that can break source.
     metadata:
       oauthlint-rule-id: AUTH-COOKIE-001
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-secure

package/rules/flow/oauth-credential-in-log.yml

@@ -0,0 +1,97 @@
+rules:
+  - id: auth.flow.oauth-credential-in-log
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      An OAuth/OIDC credential taken from the request — an authorization
+      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
+      `token`, a `client_secret`, or the raw `Authorization` header — flows
+      into a logging call (`console.*` or `logger.*`). Logs are written to
+      files, shipped to aggregators (Datadog, Splunk, CloudWatch) and read by
+      people and systems that should never see live credentials. A leaked
+      authorization code or token can be replayed to impersonate the user or
+      complete the OAuth exchange (CWE-532).
+
+      Never log the raw credential. Redact or mask it before logging
+      (`token.slice(0, 4) + '…'`), log a non-sensitive identifier instead
+      (a user id, a key id), or drop the field entirely.
+    # Taint mode so indirection is caught — `const at = req.query.access_token;
+    # logger.info(at)` flags, not just the inline `console.log(req.query.code)`
+    # form. Distinct from auth.flow.secret-in-log (a search-mode rule keyed on
+    # the NAME of the logged identifier): this is a dataflow rule keyed on the
+    # request SOURCE, so it fires even when the credential is carried through an
+    # arbitrarily-named intermediate variable. The source list is narrowed to
+    # OAuth/OIDC credential fields (and the Authorization header), so logging a
+    # benign request field such as `req.query.page` does not fire. Routing the
+    # value through a redaction/masking helper or a truncating slice clears the
+    # taint.
+    mode: taint
+    pattern-sources:
+      # Dotted accessor: req.query.code / req.body.access_token / …
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.query.$K
+              - pattern: $REQ.body.$K
+              - pattern: $REQ.params.$K
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^(?:code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)$
+      # Index accessor: req.query['id_token'] / req.body["code"] / …
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.query[$K]
+              - pattern: $REQ.body[$K]
+              - pattern: $REQ.params[$K]
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^["'](?:code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)["']$
+      # Raw Authorization header (carries the bearer token / basic credentials).
+      - pattern: $REQ.headers.authorization
+      - pattern: $REQ.headers['authorization']
+      - pattern: $REQ.headers["authorization"]
+      - pattern: $REQ.get('authorization')
+      - pattern: $REQ.get('Authorization')
+      - pattern: $REQ.header('authorization')
+      - pattern: $REQ.header('Authorization')
+    pattern-sanitizers:
+      # Redaction / masking helpers, or a truncating slice/substring — the value
+      # that reaches the log is no longer the live credential.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: maskToken(...)
+      - pattern: $S.slice(...)
+      - pattern: $S.substring(...)
+      - pattern: $S.substr(...)
+    pattern-sinks:
+      # console.log/info/debug/warn/error(...) — any tainted argument fires.
+      - patterns:
+          - pattern-either:
+              - pattern: console.log(...)
+              - pattern: console.info(...)
+              - pattern: console.debug(...)
+              - pattern: console.warn(...)
+              - pattern: console.error(...)
+      # logger.<level>(...) — a log-named receiver with a log-level method.
+      - patterns:
+          - pattern: $LOG.$LEVEL(...)
+          - metavariable-regex:
+              metavariable: $LOG
+              regex: (?i)^.*log(?:ger)?$
+          - metavariable-regex:
+              metavariable: $LEVEL
+              regex: ^(?:log|info|debug|warn|warning|error|trace|fatal|verbose|silly)$
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-013
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-oauth-credential-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - express
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.3
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/flow/secret-in-response.yml

@@ -0,0 +1,70 @@
+rules:
+  - id: auth.flow.secret-in-response
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      A server-side secret read from `process.env` flows into an HTTP
+      response body. Whatever you put in `res.send` / `res.json` / `res.end`
+      ships straight to the client, so returning a credential here publishes
+      it to every caller — it ends up in the browser, in proxies, and in any
+      logged response (CWE-200, Sensitive Information Exposure).
+
+      Never send a server secret to the client. Return only the data the
+      caller needs; if the response must reference a credential, send a
+      non-sensitive identifier (a key id, the last four characters) or a
+      redacted/masked value instead. Keep API keys, passwords, tokens, and
+      private keys server-side only.
+    # Reverse-direction taint rule: the SOURCE is the secret (a `process.env.*`
+    # value whose NAME looks like a credential) and the SINK is the Express
+    # response body — the opposite of the request->sink flow rules (ssrf,
+    # open-redirect). Taint mode catches indirection: `const k =
+    # process.env.API_KEY; res.send(k)` flags, not just the inline form.
+    #
+    # Low-FP control is the source NAME regex: it requires a credential-shaped
+    # name AND excludes the client-public prefixes (PUBLIC_, NEXT_PUBLIC_,
+    # VITE_, REACT_APP_, EXPO_PUBLIC_) whose values are exposed to the browser
+    # by design — sending those back is not a leak. Distinct from
+    # auth.secret.public-env-secret, which is a build-time *exposure* check on
+    # the env-var name alone; this rule is a *runtime dataflow* into a response.
+    mode: taint
+    pattern-sources:
+      # process.env.SECRET_NAME — member-access form.
+      - patterns:
+          - pattern: process.env.$KEY
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: (?i)^(?!(?:NEXT_PUBLIC|EXPO_PUBLIC|REACT_APP|PUBLIC|VITE)_).*(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|client[_-]?secret|credential|access[_-]?key).*$
+      # process.env['SECRET_NAME'] — index form.
+      - patterns:
+          - pattern: process.env[$K]
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^(?!(?:NEXT_PUBLIC|EXPO_PUBLIC|REACT_APP|PUBLIC|VITE)_).*(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|client[_-]?secret|credential|access[_-]?key).*$
+    pattern-sanitizers:
+      # Routing the value through a redaction/masking helper clears the taint:
+      # the masked/redacted form is no longer the live secret.
+      - pattern: redact(...)
+      - pattern: mask(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: $RES.send($X)
+              - pattern: $RES.json($X)
+              - pattern: $RES.jsonp($X)
+              - pattern: $RES.end($X)
+              - pattern: $RES.write($X)
+          - focus-metavariable: $X
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-012
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-secret-in-response
+      category: security
+      cwe: CWE-200
+      owasp: API3:2023
+      llm-prevalence: HIGH
+      technology:
+        - express
+      references:
+        - https://cwe.mitre.org/data/definitions/200.html
+        - https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/

package/rules/go/cookie/insecure.yml

@@ -14,13 +14,22 @@ rules:
       Set `Secure: true` and `HttpOnly: true` on auth cookies, and add an
       appropriate `SameSite` mode (for example `SameSite: http.SameSiteLaxMode`).
     # Matches only the literal `false`. `Secure: true`, `HttpOnly: true`, and
-    # the absence of the field are not flagged. Works for `http.Cookie{...}`
-    # and `&http.Cookie{...}` (the composite literal matches inside the
-    # address-of).
+    # the absence of the field are not flagged. The `pattern-inside` keeps
+    # detection scoped to an `http.Cookie{...}` (and `&http.Cookie{...}`)
+    # composite literal, so an unrelated struct exposing a `Secure`/`HttpOnly`
+    # bool is never matched. `$FIELD` captures the offending field name so the
+    # narrow match — and the autofix below — targets just that field.
     patterns:
-      - pattern-either:
-          - pattern: 'http.Cookie{..., Secure: false, ...}'
-          - pattern: 'http.Cookie{..., HttpOnly: false, ...}'
+      - pattern-inside: 'http.Cookie{...}'
+      - pattern: '$FIELD: false'
+      - metavariable-regex:
+          metavariable: $FIELD
+          regex: ^(Secure|HttpOnly)$
+    # Safe, deterministic autofix: flip the disabled flag to `true`. `$FIELD` is
+    # preserved, so `Secure: false` becomes `Secure: true` and `HttpOnly: false`
+    # becomes `HttpOnly: true` — each the secure value that resolves the finding,
+    # with every other field in the literal left untouched.
+    fix: '$FIELD: true'
     metadata:
       oauthlint-rule-id: AUTH-GO-COOKIE-001
       oauthlint-doc-url: https://oauthlint.dev/rules/go-cookie-insecure

package/rules/go/flow/oauth-credential-in-log.yml

@@ -0,0 +1,90 @@
+rules:
+  - id: auth.go.flow.oauth-credential-in-log
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      An OAuth/OIDC credential taken from the HTTP request — an authorization
+      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
+      `token`, a `client_secret`, or the raw `Authorization` header — flows
+      into a logging call (`log.*`, `slog.*`, `fmt.Print*`, or a `logger.*`
+      method). Logs are written to files, shipped to aggregators (Datadog,
+      Splunk, CloudWatch) and read by people and systems that should never see
+      live credentials. A leaked authorization code or token can be replayed
+      to impersonate the user or complete the OAuth exchange (CWE-532).
+
+      Never log the raw credential. Redact or mask it before logging, log a
+      non-sensitive identifier instead (a user id, a key id), or drop the
+      field entirely.
+    # Taint mode so indirection is caught — `at := r.FormValue("access_token");
+    # log.Println(at)` flags, not just the inline form. The source list is
+    # narrowed to OAuth/OIDC credential field names (and the Authorization
+    # header), so logging a benign request field such as `r.FormValue("page")`
+    # does not fire. Routing the value through a redaction/masking helper clears
+    # the taint.
+    mode: taint
+    pattern-sources:
+      # Request getters keyed by a credential-looking parameter name.
+      - patterns:
+          - pattern-either:
+              - pattern: $R.URL.Query().Get($K)
+              - pattern: $R.FormValue($K)
+              - pattern: $R.PostFormValue($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^"(code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)"$
+      # The raw Authorization header carries the bearer / basic credential.
+      - patterns:
+          - pattern: $R.Header.Get($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^"authorization"$
+    pattern-sanitizers:
+      # Redaction / masking helpers — the value reaching the log is no longer
+      # the live credential.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: maskToken(...)
+    pattern-sinks:
+      # Standard library log / slog / fmt print sinks — any tainted argument.
+      - patterns:
+          - pattern-either:
+              - pattern: log.Print(...)
+              - pattern: log.Printf(...)
+              - pattern: log.Println(...)
+              - pattern: log.Fatal(...)
+              - pattern: log.Fatalf(...)
+              - pattern: log.Fatalln(...)
+              - pattern: log.Panic(...)
+              - pattern: log.Panicf(...)
+              - pattern: slog.Info(...)
+              - pattern: slog.Debug(...)
+              - pattern: slog.Warn(...)
+              - pattern: slog.Error(...)
+              - pattern: fmt.Print(...)
+              - pattern: fmt.Printf(...)
+              - pattern: fmt.Println(...)
+      # A log-named receiver with a log-level method: logger.Info(...),
+      # myLog.Printf(...). The receiver-name constraint keeps this off
+      # unrelated method calls.
+      - patterns:
+          - pattern: $LOG.$LEVEL(...)
+          - metavariable-regex:
+              metavariable: $LOG
+              regex: (?i)^.*log(ger)?$
+          - metavariable-regex:
+              metavariable: $LEVEL
+              regex: ^(Print|Printf|Println|Info|Infof|Infow|Debug|Debugf|Debugw|Warn|Warnf|Warning|Error|Errorf|Errorw|Fatal|Fatalf|Panic|Panicf|Trace|Tracef)$
+    metadata:
+      oauthlint-rule-id: AUTH-GO-FLOW-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-flow-oauth-credential-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - net/http
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.3
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/go/flow/secret-in-response.yml

@@ -0,0 +1,69 @@
+rules:
+  - id: auth.go.flow.secret-in-response
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      A server-side secret read from the environment flows into an HTTP
+      response body, leaking it to the client. Values such as an API key,
+      client secret, access key, or private key are meant to stay on the
+      server; writing one to the `http.ResponseWriter` (via `Write`,
+      `fmt.Fprint(f)`, `io.WriteString`, or a JSON encoder) publishes it to
+      every caller — including attackers probing your endpoints.
+
+      Never return a credential to the client. Send only the data the caller
+      legitimately needs; if a secret must appear in a debug/diagnostic path,
+      redact or mask it first. Read secrets exclusively in server-internal
+      code and keep them out of any response payload. See CWE-200.
+    # Reverse-direction taint: the SOURCE is the secret (an os.Getenv /
+    # os.LookupEnv read whose key name looks like a credential) and the SINK is
+    # the HTTP response. Taint mode so indirection (s := os.Getenv("API_KEY");
+    # w.Write([]byte(s))) is caught, not just the inline form. The taint is
+    # cleared by a redaction/mask helper before the value reaches the response.
+    mode: taint
+    pattern-sources:
+      # $KEY is the env-var name literal. The metavariable-regex keeps only
+      # names that look like a credential, while a single negative lookahead
+      # excludes client-public prefixes (PUBLIC_ / NEXT_PUBLIC_) — those ship to
+      # the browser by design and are not server secrets.
+      - patterns:
+          - pattern-either:
+              - pattern: os.Getenv($KEY)
+              - pattern: os.LookupEnv($KEY)
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: (?i)^(?!"?(next_)?public_)"?.*(secret|password|passwd|token|api[_-]?key|private[_-]?key|client[_-]?secret|credential|access[_-]?key).*"?$
+    pattern-sanitizers:
+      # A redaction/mask helper clears the taint: the value written to the
+      # response is no longer the raw secret.
+      - pattern: redact(...)
+      - pattern: mask(...)
+    pattern-sinks:
+      # Focus the value argument so the finding lands on the leaked secret, not
+      # the whole call. Plain-call forms (no aliasing) match reliably in taint
+      # mode. $W is the http.ResponseWriter.
+      - patterns:
+          - pattern-either:
+              - pattern: $W.Write($X)
+              - pattern: fmt.Fprint($W, $X)
+              - pattern: fmt.Fprintf($W, $FMT, $X)
+              - pattern: io.WriteString($W, $X)
+              - pattern: json.NewEncoder($W).Encode($X)
+          # The env-read SOURCE shapes are disjoint from these response sinks,
+          # but exclude them explicitly so an env read is only ever a source,
+          # never re-counted as a sink.
+          - pattern-not: os.Getenv(...)
+          - pattern-not: os.LookupEnv(...)
+          - focus-metavariable: $X
+    metadata:
+      oauthlint-rule-id: AUTH-GO-FLOW-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-flow-secret-in-response
+      category: security
+      cwe: CWE-200
+      owasp: API3:2023
+      llm-prevalence: HIGH
+      technology:
+        - net/http
+      references:
+        - https://cwe.mitre.org/data/definitions/200.html
+        - https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/

package/rules/go/jwt/untrusted-verify-key.yml

@@ -0,0 +1,68 @@
+rules:
+  - id: auth.go.jwt.untrusted-verify-key
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the verification key returned by a
+      `golang-jwt` `Keyfunc` (or into the `WithValidMethods` allowlist). When
+      the attacker controls the key, they sign their own forged token and
+      supply the matching key, so every token "verifies" — a complete
+      authentication bypass. When the attacker controls the accepted methods,
+      they can downgrade verification and defeat the signature check (CWE-347,
+      Improper Verification of Cryptographic Signature).
+
+      The verification key and the accepted algorithms must be fixed
+      server-side. Return the key from trusted configuration or a vetted key
+      set keyed by a validated `kid`, and pin accepted methods to a constant
+      allowlist — never resolve them from `r.URL.Query()`, `r.FormValue`, or a
+      request header.
+    # Taint mode. The source is request input; the sink is the value RETURNED
+    # from a keyfunc (focused on the key expression, not the token) or the
+    # argument to `jwt.WithValidMethods`. Focusing on the key/methods — never
+    # the token, which is supposed to come from the request — keeps this from
+    # firing on every correct call. Distinct from auth.go.jwt.unchecked-method
+    # (a keyfunc that skips the `token.Method` check): this is about a
+    # request-CONTROLLED key or method list. Routing the value through an
+    # allow-list / validation helper clears the taint.
+    mode: taint
+    pattern-sources:
+      - pattern: $R.URL.Query().Get(...)
+      - pattern: $R.URL.Query()[$K]
+      - pattern: $R.FormValue(...)
+      - pattern: $R.PostFormValue(...)
+      - pattern: $R.Header.Get(...)
+      - pattern: $R.PathValue(...)
+    pattern-sanitizers:
+      - pattern: isAllowedKey(...)
+      - pattern: validateKey(...)
+      - pattern: isAllowedAlgorithm(...)
+      - pattern: validateAlgorithm(...)
+    pattern-sinks:
+      # The key returned from a golang-jwt Keyfunc literal. Scoped with
+      # pattern-inside so only a keyfunc return is a sink, and focused on the
+      # returned key expression so the token argument is never the trigger.
+      - patterns:
+          - pattern-inside: |
+              func($T *jwt.Token) ($RET, error) {
+                ...
+              }
+          - pattern: return $SINK, $E
+          - focus-metavariable: $SINK
+      # Request input used as the accepted signing methods.
+      - patterns:
+          - pattern: jwt.WithValidMethods($SINK)
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-GO-JWT-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-jwt-untrusted-verify-key
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - golang-jwt
+      references:
+        - https://cwe.mitre.org/data/definitions/347.html
+        - https://pkg.go.dev/github.com/golang-jwt/jwt/v5#Keyfunc
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1

package/rules/go/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.go.oauth.insecure-token-endpoint
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read
+      or rewrite them and take over the flow.
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, and userinfo
+      URL (including `oauth2.Endpoint{AuthURL, TokenURL}`).
+      `http://localhost` is fine for local development and is not flagged.
+    # A string literal that targets an OAuth/OIDC endpoint over http://.
+    # Required OAuth markers keep this precise: a generic http URL is NOT
+    # flagged, only one carrying an authorize/token request or an /oauth path.
+    # `https://` cannot match (the scheme is `http://` literally), and the
+    # localhost / loopback dev hosts are subtracted below.
+    patterns:
+      - pattern-regex: |-
+          "http://[^"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token)[^"]*"
+      - pattern-not-regex: |-
+          http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-GO-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/go/oauth/ropc-grant.yml

@@ -0,0 +1,49 @@
+rules:
+  - id: auth.go.oauth.ropc-grant
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials
+      grant (`grant_type=password`). The app collects the user's password
+      and replays it to the authorization server — exactly what OAuth was
+      designed to avoid. It cannot support federation, MFA, or step-up
+      auth, and any compromise of your service exposes raw user passwords.
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or
+      `client_credentials` for machine-to-machine. With `golang.org/x/oauth2`,
+      avoid `Config.PasswordCredentialsToken` and use `AuthCodeURL` /
+      `Exchange` instead.
+    pattern-either:
+      # golang.org/x/oauth2: Config.PasswordCredentialsToken(ctx, user, pass)
+      # is the ROPC helper — its only purpose is the password grant.
+      - pattern: $C.PasswordCredentialsToken(...)
+      # url.Values builders: v.Set("grant_type", "password") /
+      # v.Add("grant_type", "password"). The value is bounded so
+      # `password_reset` and friends are not matched.
+      - pattern-regex: |-
+              "grant_type"\s*,\s*"password"
+      # url.Values / map composite literal: {"grant_type": {"password"}} or
+      # {"grant_type": "password"}.
+      - pattern-regex: |-
+              "grant_type"\s*:\s*\[?\s*\{?\s*"password"
+      # URL-encoded request body string: "grant_type=password&username=…"
+      # (double-quoted or raw backtick string). The trailing class bounds the
+      # value so only the password grant matches.
+      - pattern-regex: |-
+              [?&"`]grant_type=password(?:[&"`\s\\]|$)
+    metadata:
+      oauthlint-rule-id: AUTH-GO-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/go/oauth/static-state.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.go.oauth.static-state
+    languages:
+      - go
+    severity: WARNING
+    message: |
+      OAuth authorization request is built with a hardcoded, constant `state`
+      value. A static `state` provides ZERO CSRF protection — the whole point
+      is an unguessable, per-request value that you store and then compare on
+      the callback. A literal that ships in your source is known to everyone
+      and identical on every request, so an attacker can forge a matching
+      callback.
+
+      Generate `state` fresh per request from a CSPRNG (e.g.
+      `crypto/rand` -> `base64.URLEncoding.EncodeToString(b)`), persist it in
+      the session/cookie, and verify it when the provider redirects back. With
+      `golang.org/x/oauth2`, pass that random value as the first argument to
+      `Config.AuthCodeURL(state, ...)`.
+    # `Config.AuthCodeURL(state, ...)` is the golang.org/x/oauth2 authorize-URL
+    # builder; its first argument is the CSRF `state`. A string LITERAL there is
+    # constant on every request and cannot provide CSRF protection. A
+    # per-request value is a variable (not a quoted literal) and does not match.
+    # The empty-string form is excluded — that is a missing state, covered
+    # elsewhere — so this fires only on a genuinely hardcoded value.
+    patterns:
+      - pattern: $C.AuthCodeURL("...", ...)
+      - pattern-not: $C.AuthCodeURL("", ...)
+    metadata:
+      oauthlint-rule-id: AUTH-GO-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/go/tls/insecure-skip-verify.yml

@@ -15,9 +15,20 @@ rules:
       To trust a private CA in development, set `RootCAs` to a `*x509.CertPool`
       loaded with that CA instead.
     # Matches only the literal `true`. `InsecureSkipVerify: false` and the
-    # field's absence are not flagged. Works for `tls.Config{...}` and
-    # `&tls.Config{...}` (the composite literal matches inside the address-of).
-    pattern: 'tls.Config{..., InsecureSkipVerify: true, ...}'
+    # field's absence are not flagged. The `pattern-inside` keeps detection
+    # scoped to a `tls.Config{...}` (and `&tls.Config{...}`) composite literal,
+    # so an unrelated struct that happens to expose an `InsecureSkipVerify`
+    # field is never matched. Narrowing the matched node to the field itself
+    # (rather than the whole literal) is what lets the autofix below rewrite
+    # just that field and leave the surrounding `...` fields untouched.
+    patterns:
+      - pattern-inside: 'tls.Config{...}'
+      - pattern: 'InsecureSkipVerify: true'
+    # Safe, deterministic autofix: flip the boolean to `false`, the secure
+    # default that restores certificate verification and fully resolves the
+    # finding. Only the `true` literal changes; every other field in the
+    # `tls.Config` is preserved verbatim.
+    fix: 'InsecureSkipVerify: false'
     metadata:
       oauthlint-rule-id: AUTH-GO-TLS-001
       oauthlint-doc-url: https://oauthlint.dev/rules/go-tls-insecure-skip-verify