oauthlint-rules 0.2.6 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.2.6",
+  "version": "0.3.0",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/cookie/no-httponly.yml

@@ -39,7 +39,11 @@ rules:
           - metavariable-regex:
               metavariable: $NAME
               regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
-    fix: '$RES.cookie($NAME, $VAL, { ...$OPTS, httpOnly: true })'
+    # No autofix. As with `auth.cookie.no-secure`, a single rule-level `fix:`
+    # cannot cover all three matched shapes safely: a spread template corrupts
+    # the 2-arg form (unbound `$OPTS` is emitted literally) and does not resolve
+    # an explicit `httpOnly: false`. Inserting a missing key is not a clean
+    # literal replacement, so this rule deliberately ships no `fix:`.
     metadata:
       oauthlint-rule-id: AUTH-COOKIE-002
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-httponly

package/rules/cookie/no-samesite.yml

@@ -41,7 +41,11 @@ rules:
                     - pattern: "{..., sameSite: 'None', ...}"
                     - pattern: '{..., sameSite: "None", ...}'
                 - pattern-not: '{..., secure: true, ...}'
-    fix: "$RES.cookie($NAME, $VAL, { ...$OPTS, sameSite: 'strict' })"
+    # No autofix. The correct `SameSite` value is context-dependent — `Strict`
+    # suits most auth flows but breaks OAuth callbacks, which need `Lax`, while a
+    # cookie deliberately set cross-site needs `None` plus `Secure`. The tool
+    # cannot know which, and a spread template would also corrupt the 2-arg form
+    # (unbound `$OPTS`). So this rule deliberately ships no `fix:`.
     metadata:
       oauthlint-rule-id: AUTH-COOKIE-003
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-samesite

package/rules/cookie/no-secure.yml

@@ -39,11 +39,14 @@ rules:
           - metavariable-regex:
               metavariable: $NAME
               regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
-    # Auto-fix applies to the first (3-arg) pattern: spread the existing
-    # options object and inject secure:true. Verbose but always-correct;
-    # users can run prettier afterwards. The 2-arg branch is left alone
-    # because rewriting it requires inserting a brand-new argument.
-    fix: '$RES.cookie($NAME, $VAL, { ...$OPTS, secure: true })'
+    # No autofix. A single rule-level `fix:` cannot be made safe here: this rule
+    # matches three shapes — an options object missing `secure`, the 2-arg form
+    # with no options object at all, and an explicit `secure: false`. A spread
+    # template like `{ ...$OPTS, secure: true }` corrupts the 2-arg form (`$OPTS`
+    # is unbound, so Semgrep emits the literal text `$OPTS`) and leaves an
+    # explicit `secure: false` key in place (the finding re-fires). Inserting a
+    # brand-new argument/key is not a clean literal replacement, so we ship no
+    # `fix:` rather than a rewrite that can break source.
     metadata:
       oauthlint-rule-id: AUTH-COOKIE-001
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-secure

package/rules/flow/oauth-credential-in-log.yml

@@ -0,0 +1,97 @@
+rules:
+  - id: auth.flow.oauth-credential-in-log
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      An OAuth/OIDC credential taken from the request — an authorization
+      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
+      `token`, a `client_secret`, or the raw `Authorization` header — flows
+      into a logging call (`console.*` or `logger.*`). Logs are written to
+      files, shipped to aggregators (Datadog, Splunk, CloudWatch) and read by
+      people and systems that should never see live credentials. A leaked
+      authorization code or token can be replayed to impersonate the user or
+      complete the OAuth exchange (CWE-532).
+
+      Never log the raw credential. Redact or mask it before logging
+      (`token.slice(0, 4) + '…'`), log a non-sensitive identifier instead
+      (a user id, a key id), or drop the field entirely.
+    # Taint mode so indirection is caught — `const at = req.query.access_token;
+    # logger.info(at)` flags, not just the inline `console.log(req.query.code)`
+    # form. Distinct from auth.flow.secret-in-log (a search-mode rule keyed on
+    # the NAME of the logged identifier): this is a dataflow rule keyed on the
+    # request SOURCE, so it fires even when the credential is carried through an
+    # arbitrarily-named intermediate variable. The source list is narrowed to
+    # OAuth/OIDC credential fields (and the Authorization header), so logging a
+    # benign request field such as `req.query.page` does not fire. Routing the
+    # value through a redaction/masking helper or a truncating slice clears the
+    # taint.
+    mode: taint
+    pattern-sources:
+      # Dotted accessor: req.query.code / req.body.access_token / …
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.query.$K
+              - pattern: $REQ.body.$K
+              - pattern: $REQ.params.$K
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^(?:code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)$
+      # Index accessor: req.query['id_token'] / req.body["code"] / …
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.query[$K]
+              - pattern: $REQ.body[$K]
+              - pattern: $REQ.params[$K]
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^["'](?:code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)["']$
+      # Raw Authorization header (carries the bearer token / basic credentials).
+      - pattern: $REQ.headers.authorization
+      - pattern: $REQ.headers['authorization']
+      - pattern: $REQ.headers["authorization"]
+      - pattern: $REQ.get('authorization')
+      - pattern: $REQ.get('Authorization')
+      - pattern: $REQ.header('authorization')
+      - pattern: $REQ.header('Authorization')
+    pattern-sanitizers:
+      # Redaction / masking helpers, or a truncating slice/substring — the value
+      # that reaches the log is no longer the live credential.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: maskToken(...)
+      - pattern: $S.slice(...)
+      - pattern: $S.substring(...)
+      - pattern: $S.substr(...)
+    pattern-sinks:
+      # console.log/info/debug/warn/error(...) — any tainted argument fires.
+      - patterns:
+          - pattern-either:
+              - pattern: console.log(...)
+              - pattern: console.info(...)
+              - pattern: console.debug(...)
+              - pattern: console.warn(...)
+              - pattern: console.error(...)
+      # logger.<level>(...) — a log-named receiver with a log-level method.
+      - patterns:
+          - pattern: $LOG.$LEVEL(...)
+          - metavariable-regex:
+              metavariable: $LOG
+              regex: (?i)^.*log(?:ger)?$
+          - metavariable-regex:
+              metavariable: $LEVEL
+              regex: ^(?:log|info|debug|warn|warning|error|trace|fatal|verbose|silly)$
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-013
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-oauth-credential-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - express
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.3
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/go/cookie/insecure.yml

@@ -14,13 +14,22 @@ rules:
       Set `Secure: true` and `HttpOnly: true` on auth cookies, and add an
       appropriate `SameSite` mode (for example `SameSite: http.SameSiteLaxMode`).
     # Matches only the literal `false`. `Secure: true`, `HttpOnly: true`, and
-    # the absence of the field are not flagged. Works for `http.Cookie{...}`
-    # and `&http.Cookie{...}` (the composite literal matches inside the
-    # address-of).
+    # the absence of the field are not flagged. The `pattern-inside` keeps
+    # detection scoped to an `http.Cookie{...}` (and `&http.Cookie{...}`)
+    # composite literal, so an unrelated struct exposing a `Secure`/`HttpOnly`
+    # bool is never matched. `$FIELD` captures the offending field name so the
+    # narrow match — and the autofix below — targets just that field.
     patterns:
-      - pattern-either:
-          - pattern: 'http.Cookie{..., Secure: false, ...}'
-          - pattern: 'http.Cookie{..., HttpOnly: false, ...}'
+      - pattern-inside: 'http.Cookie{...}'
+      - pattern: '$FIELD: false'
+      - metavariable-regex:
+          metavariable: $FIELD
+          regex: ^(Secure|HttpOnly)$
+    # Safe, deterministic autofix: flip the disabled flag to `true`. `$FIELD` is
+    # preserved, so `Secure: false` becomes `Secure: true` and `HttpOnly: false`
+    # becomes `HttpOnly: true` — each the secure value that resolves the finding,
+    # with every other field in the literal left untouched.
+    fix: '$FIELD: true'
     metadata:
       oauthlint-rule-id: AUTH-GO-COOKIE-001
       oauthlint-doc-url: https://oauthlint.dev/rules/go-cookie-insecure

package/rules/go/flow/oauth-credential-in-log.yml

@@ -0,0 +1,90 @@
+rules:
+  - id: auth.go.flow.oauth-credential-in-log
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      An OAuth/OIDC credential taken from the HTTP request — an authorization
+      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
+      `token`, a `client_secret`, or the raw `Authorization` header — flows
+      into a logging call (`log.*`, `slog.*`, `fmt.Print*`, or a `logger.*`
+      method). Logs are written to files, shipped to aggregators (Datadog,
+      Splunk, CloudWatch) and read by people and systems that should never see
+      live credentials. A leaked authorization code or token can be replayed
+      to impersonate the user or complete the OAuth exchange (CWE-532).
+
+      Never log the raw credential. Redact or mask it before logging, log a
+      non-sensitive identifier instead (a user id, a key id), or drop the
+      field entirely.
+    # Taint mode so indirection is caught — `at := r.FormValue("access_token");
+    # log.Println(at)` flags, not just the inline form. The source list is
+    # narrowed to OAuth/OIDC credential field names (and the Authorization
+    # header), so logging a benign request field such as `r.FormValue("page")`
+    # does not fire. Routing the value through a redaction/masking helper clears
+    # the taint.
+    mode: taint
+    pattern-sources:
+      # Request getters keyed by a credential-looking parameter name.
+      - patterns:
+          - pattern-either:
+              - pattern: $R.URL.Query().Get($K)
+              - pattern: $R.FormValue($K)
+              - pattern: $R.PostFormValue($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^"(code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)"$
+      # The raw Authorization header carries the bearer / basic credential.
+      - patterns:
+          - pattern: $R.Header.Get($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^"authorization"$
+    pattern-sanitizers:
+      # Redaction / masking helpers — the value reaching the log is no longer
+      # the live credential.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: maskToken(...)
+    pattern-sinks:
+      # Standard library log / slog / fmt print sinks — any tainted argument.
+      - patterns:
+          - pattern-either:
+              - pattern: log.Print(...)
+              - pattern: log.Printf(...)
+              - pattern: log.Println(...)
+              - pattern: log.Fatal(...)
+              - pattern: log.Fatalf(...)
+              - pattern: log.Fatalln(...)
+              - pattern: log.Panic(...)
+              - pattern: log.Panicf(...)
+              - pattern: slog.Info(...)
+              - pattern: slog.Debug(...)
+              - pattern: slog.Warn(...)
+              - pattern: slog.Error(...)
+              - pattern: fmt.Print(...)
+              - pattern: fmt.Printf(...)
+              - pattern: fmt.Println(...)
+      # A log-named receiver with a log-level method: logger.Info(...),
+      # myLog.Printf(...). The receiver-name constraint keeps this off
+      # unrelated method calls.
+      - patterns:
+          - pattern: $LOG.$LEVEL(...)
+          - metavariable-regex:
+              metavariable: $LOG
+              regex: (?i)^.*log(ger)?$
+          - metavariable-regex:
+              metavariable: $LEVEL
+              regex: ^(Print|Printf|Println|Info|Infof|Infow|Debug|Debugf|Debugw|Warn|Warnf|Warning|Error|Errorf|Errorw|Fatal|Fatalf|Panic|Panicf|Trace|Tracef)$
+    metadata:
+      oauthlint-rule-id: AUTH-GO-FLOW-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-flow-oauth-credential-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - net/http
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.3
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/go/jwt/untrusted-verify-key.yml

@@ -0,0 +1,68 @@
+rules:
+  - id: auth.go.jwt.untrusted-verify-key
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the verification key returned by a
+      `golang-jwt` `Keyfunc` (or into the `WithValidMethods` allowlist). When
+      the attacker controls the key, they sign their own forged token and
+      supply the matching key, so every token "verifies" — a complete
+      authentication bypass. When the attacker controls the accepted methods,
+      they can downgrade verification and defeat the signature check (CWE-347,
+      Improper Verification of Cryptographic Signature).
+
+      The verification key and the accepted algorithms must be fixed
+      server-side. Return the key from trusted configuration or a vetted key
+      set keyed by a validated `kid`, and pin accepted methods to a constant
+      allowlist — never resolve them from `r.URL.Query()`, `r.FormValue`, or a
+      request header.
+    # Taint mode. The source is request input; the sink is the value RETURNED
+    # from a keyfunc (focused on the key expression, not the token) or the
+    # argument to `jwt.WithValidMethods`. Focusing on the key/methods — never
+    # the token, which is supposed to come from the request — keeps this from
+    # firing on every correct call. Distinct from auth.go.jwt.unchecked-method
+    # (a keyfunc that skips the `token.Method` check): this is about a
+    # request-CONTROLLED key or method list. Routing the value through an
+    # allow-list / validation helper clears the taint.
+    mode: taint
+    pattern-sources:
+      - pattern: $R.URL.Query().Get(...)
+      - pattern: $R.URL.Query()[$K]
+      - pattern: $R.FormValue(...)
+      - pattern: $R.PostFormValue(...)
+      - pattern: $R.Header.Get(...)
+      - pattern: $R.PathValue(...)
+    pattern-sanitizers:
+      - pattern: isAllowedKey(...)
+      - pattern: validateKey(...)
+      - pattern: isAllowedAlgorithm(...)
+      - pattern: validateAlgorithm(...)
+    pattern-sinks:
+      # The key returned from a golang-jwt Keyfunc literal. Scoped with
+      # pattern-inside so only a keyfunc return is a sink, and focused on the
+      # returned key expression so the token argument is never the trigger.
+      - patterns:
+          - pattern-inside: |
+              func($T *jwt.Token) ($RET, error) {
+                ...
+              }
+          - pattern: return $SINK, $E
+          - focus-metavariable: $SINK
+      # Request input used as the accepted signing methods.
+      - patterns:
+          - pattern: jwt.WithValidMethods($SINK)
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-GO-JWT-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-jwt-untrusted-verify-key
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - golang-jwt
+      references:
+        - https://cwe.mitre.org/data/definitions/347.html
+        - https://pkg.go.dev/github.com/golang-jwt/jwt/v5#Keyfunc
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1

package/rules/go/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.go.oauth.insecure-token-endpoint
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read
+      or rewrite them and take over the flow.
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, and userinfo
+      URL (including `oauth2.Endpoint{AuthURL, TokenURL}`).
+      `http://localhost` is fine for local development and is not flagged.
+    # A string literal that targets an OAuth/OIDC endpoint over http://.
+    # Required OAuth markers keep this precise: a generic http URL is NOT
+    # flagged, only one carrying an authorize/token request or an /oauth path.
+    # `https://` cannot match (the scheme is `http://` literally), and the
+    # localhost / loopback dev hosts are subtracted below.
+    patterns:
+      - pattern-regex: |-
+          "http://[^"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token)[^"]*"
+      - pattern-not-regex: |-
+          http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-GO-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/go/oauth/ropc-grant.yml

@@ -0,0 +1,49 @@
+rules:
+  - id: auth.go.oauth.ropc-grant
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials
+      grant (`grant_type=password`). The app collects the user's password
+      and replays it to the authorization server — exactly what OAuth was
+      designed to avoid. It cannot support federation, MFA, or step-up
+      auth, and any compromise of your service exposes raw user passwords.
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or
+      `client_credentials` for machine-to-machine. With `golang.org/x/oauth2`,
+      avoid `Config.PasswordCredentialsToken` and use `AuthCodeURL` /
+      `Exchange` instead.
+    pattern-either:
+      # golang.org/x/oauth2: Config.PasswordCredentialsToken(ctx, user, pass)
+      # is the ROPC helper — its only purpose is the password grant.
+      - pattern: $C.PasswordCredentialsToken(...)
+      # url.Values builders: v.Set("grant_type", "password") /
+      # v.Add("grant_type", "password"). The value is bounded so
+      # `password_reset` and friends are not matched.
+      - pattern-regex: |-
+              "grant_type"\s*,\s*"password"
+      # url.Values / map composite literal: {"grant_type": {"password"}} or
+      # {"grant_type": "password"}.
+      - pattern-regex: |-
+              "grant_type"\s*:\s*\[?\s*\{?\s*"password"
+      # URL-encoded request body string: "grant_type=password&username=…"
+      # (double-quoted or raw backtick string). The trailing class bounds the
+      # value so only the password grant matches.
+      - pattern-regex: |-
+              [?&"`]grant_type=password(?:[&"`\s\\]|$)
+    metadata:
+      oauthlint-rule-id: AUTH-GO-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/go/oauth/static-state.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.go.oauth.static-state
+    languages:
+      - go
+    severity: WARNING
+    message: |
+      OAuth authorization request is built with a hardcoded, constant `state`
+      value. A static `state` provides ZERO CSRF protection — the whole point
+      is an unguessable, per-request value that you store and then compare on
+      the callback. A literal that ships in your source is known to everyone
+      and identical on every request, so an attacker can forge a matching
+      callback.
+
+      Generate `state` fresh per request from a CSPRNG (e.g.
+      `crypto/rand` -> `base64.URLEncoding.EncodeToString(b)`), persist it in
+      the session/cookie, and verify it when the provider redirects back. With
+      `golang.org/x/oauth2`, pass that random value as the first argument to
+      `Config.AuthCodeURL(state, ...)`.
+    # `Config.AuthCodeURL(state, ...)` is the golang.org/x/oauth2 authorize-URL
+    # builder; its first argument is the CSRF `state`. A string LITERAL there is
+    # constant on every request and cannot provide CSRF protection. A
+    # per-request value is a variable (not a quoted literal) and does not match.
+    # The empty-string form is excluded — that is a missing state, covered
+    # elsewhere — so this fires only on a genuinely hardcoded value.
+    patterns:
+      - pattern: $C.AuthCodeURL("...", ...)
+      - pattern-not: $C.AuthCodeURL("", ...)
+    metadata:
+      oauthlint-rule-id: AUTH-GO-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/go/tls/insecure-skip-verify.yml

@@ -15,9 +15,20 @@ rules:
       To trust a private CA in development, set `RootCAs` to a `*x509.CertPool`
       loaded with that CA instead.
     # Matches only the literal `true`. `InsecureSkipVerify: false` and the
-    # field's absence are not flagged. Works for `tls.Config{...}` and
-    # `&tls.Config{...}` (the composite literal matches inside the address-of).
-    pattern: 'tls.Config{..., InsecureSkipVerify: true, ...}'
+    # field's absence are not flagged. The `pattern-inside` keeps detection
+    # scoped to a `tls.Config{...}` (and `&tls.Config{...}`) composite literal,
+    # so an unrelated struct that happens to expose an `InsecureSkipVerify`
+    # field is never matched. Narrowing the matched node to the field itself
+    # (rather than the whole literal) is what lets the autofix below rewrite
+    # just that field and leave the surrounding `...` fields untouched.
+    patterns:
+      - pattern-inside: 'tls.Config{...}'
+      - pattern: 'InsecureSkipVerify: true'
+    # Safe, deterministic autofix: flip the boolean to `false`, the secure
+    # default that restores certificate verification and fully resolves the
+    # finding. Only the `true` literal changes; every other field in the
+    # `tls.Config` is preserved verbatim.
+    fix: 'InsecureSkipVerify: false'
     metadata:
       oauthlint-rule-id: AUTH-GO-TLS-001
       oauthlint-doc-url: https://oauthlint.dev/rules/go-tls-insecure-skip-verify

package/rules/go/tls/min-version.yml

@@ -14,13 +14,22 @@ rules:
       Set `MinVersion` to at least `tls.VersionTLS12`, and ideally
       `tls.VersionTLS13`, so the handshake refuses obsolete protocols.
     # Matches the obsolete constants only. `tls.VersionTLS12` and
-    # `tls.VersionTLS13` are not flagged. Works for both `tls.Config{...}`
-    # and `&tls.Config{...}` (the composite literal matches inside `&`).
+    # `tls.VersionTLS13` are not flagged. The `pattern-inside` keeps detection
+    # scoped to a `tls.Config{...}` (and `&tls.Config{...}`) composite literal;
+    # narrowing the matched node to the `MinVersion` field itself is what lets
+    # the autofix below rewrite just that field and leave neighbours untouched.
     patterns:
-      - pattern: 'tls.Config{..., MinVersion: $V, ...}'
+      - pattern-inside: 'tls.Config{...}'
+      - pattern: 'MinVersion: $V'
       - metavariable-regex:
           metavariable: $V
           regex: ^tls\.(VersionSSL30|VersionTLS10|VersionTLS11)$
+    # Safe, deterministic autofix: raise the floor to `tls.VersionTLS12`, the
+    # lowest version RFC 8996 still permits. This is the minimal correct upgrade
+    # — it fully resolves the finding (TLS 1.2+ is no longer flagged) without
+    # presuming the stricter `tls.VersionTLS13`, which can break interop with
+    # peers that don't yet speak 1.3.
+    fix: 'MinVersion: tls.VersionTLS12'
     metadata:
       oauthlint-rule-id: AUTH-GO-TLS-002
       oauthlint-doc-url: https://oauthlint.dev/rules/go-tls-min-version

package/rules/java/cors/credentialed-wildcard.yml

@@ -0,0 +1,44 @@
+rules:
+  - id: auth.java.cors.credentialed-wildcard
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      CORS is configured to allow any origin together with credentials. A
+      wildcard origin combined with `allowCredentials = true` tells the browser
+      to send the victim's cookies and authorization headers to a response that
+      any site can read — a cross-origin account-takeover primitive (CWE-942).
+      Because browsers reject a literal `*` when credentials are allowed,
+      `addAllowedOriginPattern("*")` exists specifically to re-enable this unsafe
+      combination, so its very use is the smell.
+
+      Never pair a wildcard origin with credentials. List the exact trusted
+      origins — `setAllowedOrigins(List.of("https://app.example.com"))` with
+      `setAllowCredentials(true)` — or drop credentials if you genuinely need a
+      public, anonymous API.
+    # Annotation form: @CrossOrigin with a wildcard origin AND allowCredentials
+    # = "true" (both attribute orderings, `origins` and the `value` alias).
+    # Programmatic form: the origin-PATTERN wildcard API, which only exists to
+    # allow `*` with credentials — flagged on its own. The plain
+    # `addAllowedOrigin`/`setAllowedOrigins` wildcards are covered by
+    # auth.java.cors.allow-all and are intentionally not duplicated here.
+    pattern-either:
+      - pattern: '@CrossOrigin(..., origins = "*", ..., allowCredentials = "true", ...)'
+      - pattern: '@CrossOrigin(..., allowCredentials = "true", ..., origins = "*", ...)'
+      - pattern: '@CrossOrigin(..., value = "*", ..., allowCredentials = "true", ...)'
+      - pattern: '@CrossOrigin(..., allowCredentials = "true", ..., value = "*", ...)'
+      - pattern: $C.addAllowedOriginPattern("*")
+      - pattern: $C.setAllowedOriginPatterns($L(..., "*", ...))
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CORS-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-cors-credentialed-wildcard
+      category: security
+      cwe: CWE-942
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - spring-web
+      references:
+        - https://docs.spring.io/spring-framework/reference/web/webmvc-cors.html
+        - https://portswigger.net/web-security/cors
+        - https://cwe.mitre.org/data/definitions/942.html

package/rules/java/jwt/none-algorithm.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: auth.java.jwt.none-algorithm
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      A JWT is created or verified with the `none` algorithm, which means there
+      is no signature at all. An `alg=none` token can be forged by anyone —
+      changing the subject, roles, or expiry costs nothing because there is no
+      signature to verify (CWE-347). This is a common AI-generated mistake: the
+      "no signature" algorithm is reached for during prototyping or testing and
+      never swapped for a real signing key.
+
+      Always sign and verify with a real algorithm. With jjwt use
+      `Jwts.builder()...signWith(key)` and a keyed parser; with Auth0 java-jwt
+      use `Algorithm.HMAC256(secret)` / `Algorithm.RSA256(...)` instead of
+      `Algorithm.none()`.
+    # jjwt (io.jsonwebtoken): the SignatureAlgorithm.NONE enum constant.
+    # Auth0 java-jwt (com.auth0.jwt): the Algorithm.none() factory.
+    pattern-either:
+      - pattern: io.jsonwebtoken.SignatureAlgorithm.NONE
+      - pattern: SignatureAlgorithm.NONE
+      - pattern: com.auth0.jwt.algorithms.Algorithm.none()
+      - pattern: Algorithm.none()
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-JWT-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-jwt-none-algorithm
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - jjwt
+        - java-jwt
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc8725#section-2.1
+        - https://cwe.mitre.org/data/definitions/347.html