oauthlint-rules 0.2.6 → 0.3.0

package/rules/java/jwt/untrusted-verify-key.yml

@@ -0,0 +1,54 @@
+rules:
+  - id: auth.java.jwt.untrusted-verify-key
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the JWT verification key. When the
+      attacker controls the key, they sign their own forged token and supply the
+      matching key, so every token "verifies" — a complete authentication bypass
+      (CWE-347, Improper Verification of Cryptographic Signature).
+
+      The verification key must be fixed server-side. Resolve it from trusted
+      configuration, a keystore, or a vetted key set keyed by a validated `kid`
+      — never from `request.getParameter(...)` / `request.getHeader(...)` or a
+      `@RequestParam` / `@RequestHeader` value.
+    # Taint mode with the sink FOCUSED on the key argument — never the token. The
+    # token is supposed to come from the request, so focusing on it would
+    # false-positive on every correct call; focusing on the key fires only when
+    # the attacker controls verification itself. Sources are the servlet request
+    # accessors that return raw client input. A key fetched from a keystore
+    # (`KeyStore.getKey(...)`) clears the taint.
+    mode: taint
+    pattern-sources:
+      - pattern: $REQ.getParameter(...)
+      - pattern: $REQ.getParameterValues(...)
+      - pattern: $REQ.getHeader(...)
+      - pattern: $REQ.getHeaders(...)
+    pattern-sanitizers:
+      - pattern: $KS.getKey(...)
+    pattern-sinks:
+      # jjwt: the signing/verification key passed to the parser.
+      - patterns:
+          - pattern-either:
+              - pattern: $P.setSigningKey($SINK)
+              - pattern: $P.verifyWith($SINK)
+          - focus-metavariable: $SINK
+      # nimbus-jose-jwt: the HMAC secret handed to the verifier.
+      - patterns:
+          - pattern: new MACVerifier($SINK)
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-JWT-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-jwt-untrusted-verify-key
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - jjwt
+        - nimbus-jose-jwt
+      references:
+        - https://cwe.mitre.org/data/definitions/347.html
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1
+        - https://owasp.org/www-project-api-security/

package/rules/java/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.java.oauth.insecure-token-endpoint
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read or
+      rewrite them and take over the flow (CWE-319).
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, and userinfo URL.
+      `http://localhost` and loopback addresses are fine for local development
+      and are not flagged.
+    # A string literal that targets an OAuth/OIDC endpoint over http://. Required
+    # OAuth markers keep this precise: a generic http URL is NOT flagged, only
+    # one carrying an authorize/token request or an /oauth path. `https://`
+    # cannot match (the scheme is literal), and localhost / loopback dev hosts
+    # are subtracted.
+    patterns:
+      - pattern-regex: |-
+          "http://[^"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token)[^"]*"
+      - pattern-not-regex: |-
+          http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/java/oauth/ropc-grant.yml

@@ -0,0 +1,45 @@
+rules:
+  - id: auth.java.oauth.ropc-grant
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials grant
+      (`grant_type=password`). The application collects the user's password and
+      replays it to the authorization server — exactly what OAuth was designed
+      to avoid. It cannot support federation, MFA, or step-up auth, and any
+      compromise of your service exposes raw user passwords (CWE-522).
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or `client_credentials`
+      for machine-to-machine.
+    # Match `grant_type=password` only where it is a token-request body, so an
+    # unrelated `grant_type` variable is never flagged.
+    #   - URL-encoded form string body: "grant_type=password&username=…". The
+    #     value is bounded so `grant_type=password_reset` is NOT matched.
+    #   - Form builders that pair the key and value as two string-literal args:
+    #     OkHttp `FormBody.Builder().add("grant_type", "password")`, Spring
+    #     `BodyInserters.fromFormData("grant_type", "password")` /
+    #     `MultiValueMap.add(...)`, Apache `new BasicNameValuePair(...)`.
+    pattern-either:
+      - pattern-regex: |-
+          [?&"']grant_type=password(?:["'&\s]|$)
+      - pattern-regex: |-
+          ["']grant_type["']\s*,\s*["']password["']
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - spring-web
+        - okhttp
+        - apache-httpclient
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/java/oauth/static-state.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.java.oauth.static-state
+    languages:
+      - java
+    severity: WARNING
+    message: |
+      OAuth authorization request sends a hardcoded, constant `state` value. A
+      static `state` provides ZERO CSRF protection — the whole point is an
+      unguessable, per-request value that you store and then compare on the
+      callback. A literal that ships in your source is known to everyone and
+      identical on every request, so an attacker can forge a matching callback
+      (CWE-330).
+
+      Generate `state` fresh per request from a CSPRNG (`new SecureRandom()` /
+      `Base64.getUrlEncoder().encodeToString(randomBytes)`), persist it in the
+      session, and verify it when the provider redirects back.
+    # An inline authorize URL string literal that carries BOTH a `response_type`
+    # (so we know it is an authorize request, not some unrelated `state` field)
+    # AND a constant `state=` value. A per-request value is built by
+    # concatenation — `"…&state=" + state` — whose literal ends right after
+    # `state=`, so the value-character class below cannot match it.
+    patterns:
+      - pattern-regex: |-
+          "https?://[^"\s]+\?[^"]*response_type=[^"]*"
+      - pattern-regex: |-
+          "https?://[^"\s]+\?[^"]*state=[A-Za-z0-9._~%-]+[^"]*"
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/java/web/permit-all-actuator.yml

@@ -0,0 +1,43 @@
+rules:
+  - id: auth.java.web.permit-all-actuator
+    languages:
+      - java
+    severity: WARNING
+    message: |
+      Spring Security grants `permitAll()` to a sensitive management path. Spring
+      Boot Actuator and similar diagnostic endpoints expose health, environment,
+      configuration, thread dumps, and heap dumps — opening them to anonymous
+      access leaks secrets and internal state and can enable remote code
+      execution (CWE-862, broken access control). This is a common AI-generated
+      mistake: the management path is opened to "fix" a probe or scrape and the
+      intended authentication is never added.
+
+      Require authentication for management endpoints — e.g.
+      `requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ADMIN")` — and
+      expose only `/actuator/health` (and `/info`) publicly if you must.
+    # Flag permitAll() on a matcher whose path literal targets a management /
+    # diagnostics surface (actuator, jolokia, heap/thread dumps, internal).
+    # Ordinary application matchers (e.g. "/public/**", "/login") are not
+    # flagged. Covers the Spring Security 6 `requestMatchers` and the legacy
+    # `antMatchers` / `mvcMatchers`.
+    patterns:
+      - pattern-either:
+          - pattern: $X.requestMatchers($P).permitAll()
+          - pattern: $X.antMatchers($P).permitAll()
+          - pattern: $X.mvcMatchers($P).permitAll()
+      - metavariable-regex:
+          metavariable: $P
+          regex: (?s).*/(?:actuator|jolokia|heapdump|threaddump|internal)\b.*
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-WEB-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-web-permit-all-actuator
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - spring-security
+        - spring-boot-actuator
+      references:
+        - https://docs.spring.io/spring-boot/reference/actuator/endpoints.html
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/jwt/ignore-expiration.yml

@@ -18,17 +18,27 @@ rules:
     # pass `ignoreExpiration: true`; `verify(...)` without that option, and
     # `ignoreExpiration: false`, are never matched. We also support the
     # destructured import `import { verify } from 'jsonwebtoken'`, scoped to that
-    # import so an unrelated `verify()` is safe. The options object is matched
-    # with `{ ..., ignoreExpiration: true, ... }` so the flag is caught
-    # regardless of which other options (algorithms, maxAge, audience, ...)
-    # appear alongside it.
-    pattern-either:
-      - pattern: 'jwt.verify($T, $K, { ..., ignoreExpiration: true, ... })'
-      - patterns:
-          - pattern-inside: |
-              import { ..., verify, ... } from 'jsonwebtoken'
-              ...
-          - pattern: 'verify($T, $K, { ..., ignoreExpiration: true, ... })'
+    # import so an unrelated `verify()` is safe. The verify call is matched with
+    # `pattern-inside` (any options object), and the matched node is narrowed to
+    # the `ignoreExpiration: true` property itself — this keeps detection
+    # identical (the flag is still caught regardless of which other options
+    # appear alongside it) while letting the autofix below rewrite just that
+    # property and leave every sibling option untouched.
+    patterns:
+      - pattern-either:
+          - pattern-inside: 'jwt.verify($T, $K, {...})'
+          - patterns:
+              - pattern-inside: |
+                  import { ..., verify, ... } from 'jsonwebtoken'
+                  ...
+              - pattern-inside: 'verify($T, $K, {...})'
+      - pattern: 'ignoreExpiration: true'
+    # Safe, deterministic autofix: flip the disabled check back on. `false` is the
+    # secure value — it is the library default (expiry enforced) and the exact
+    # value the rule treats as compliant — so the rewrite fully resolves the
+    # finding. The match is narrowed to the property, so `ignoreExpiration: true`
+    # becomes `ignoreExpiration: false` with the rest of the options object intact.
+    fix: 'ignoreExpiration: false'
     metadata:
       oauthlint-rule-id: AUTH-JWT-011
       oauthlint-doc-url: https://oauthlint.dev/rules/jwt-ignore-expiration

package/rules/jwt/untrusted-verify-key.yml

@@ -0,0 +1,77 @@
+rules:
+  - id: auth.jwt.untrusted-verify-key
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the verification key or the
+      `algorithms` allowlist of `jwt.verify(...)`. When the attacker controls
+      the key, they sign their own forged token and supply the matching key,
+      so every token "verifies" — a complete authentication bypass. When the
+      attacker controls `algorithms`, they can downgrade verification (e.g. to
+      `HS256` against a public key, or to `none` on older libraries) and defeat
+      the signature check (CWE-347, Improper Verification of Cryptographic
+      Signature).
+
+      The verification key and the accepted algorithms must be fixed
+      server-side. Pin `algorithms` to a constant allowlist
+      (`{ algorithms: ['RS256'] }`) and resolve the key from trusted
+      configuration or a vetted key set keyed by a validated `kid` — never from
+      `req.query` / `req.body` / `req.params` / `req.headers`.
+    # Taint mode with the sink FOCUSED on the key / algorithms argument — never
+    # the token. The token is supposed to come from the request, so focusing on
+    # it would false-positive on every correct call; focusing on the key and the
+    # `algorithms` value fires only when the attacker controls verification
+    # itself. Routing a candidate algorithm/key through an allow-list /
+    # validation helper clears the taint. Distinct from
+    # auth.jwt.algorithm-confusion (HS* + a PEM public key) and
+    # auth.jwt.no-algorithms-allowlist (a MISSING allowlist): this is about a
+    # request-CONTROLLED key or algorithm.
+    mode: taint
+    pattern-sources:
+      - pattern: $REQ.query
+      - pattern: $REQ.params
+      - pattern: $REQ.body
+      - pattern: $REQ.headers
+      - pattern: $REQ.query.$X
+      - pattern: $REQ.params.$X
+      - pattern: $REQ.body.$X
+      - pattern: $REQ.headers.$X
+      - pattern: $REQ.query[$K]
+      - pattern: $REQ.params[$K]
+      - pattern: $REQ.body[$K]
+      - pattern: $REQ.headers[$K]
+    pattern-sanitizers:
+      # A candidate algorithm or key vetted against an allow-list / validator is
+      # no longer attacker-controlled when it reaches verify().
+      - pattern: isAllowedAlgorithm(...)
+      - pattern: validateAlgorithm(...)
+      - pattern: isAllowedKey(...)
+      - pattern: $ALLOW.includes(...)
+      - pattern: $ALLOW.has(...)
+      - pattern: $ALLOW.indexOf(...)
+    pattern-sinks:
+      # Request input used as the verification key (2- and 3-argument forms).
+      - patterns:
+          - pattern-either:
+              - pattern: jwt.verify($T, $SINK)
+              - pattern: jwt.verify($T, $SINK, $OPTS)
+          - focus-metavariable: $SINK
+      # Request input used as the accepted `algorithms`.
+      - patterns:
+          - pattern: 'jwt.verify($T, $KEY, {..., algorithms: $SINK, ...})'
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-012
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-untrusted-verify-key
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - jsonwebtoken
+      references:
+        - https://cwe.mitre.org/data/definitions/347.html
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1
+        - https://owasp.org/www-project-api-security/

package/rules/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.oauth.insecure-token-endpoint
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read
+      or rewrite them and take over the flow.
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, and userinfo
+      URL. `http://localhost` is fine for local development and is not
+      flagged.
+    pattern-either:
+      # A string literal that targets an OAuth/OIDC endpoint over http://.
+      # Required OAuth markers keep this precise: a generic http URL is NOT
+      # flagged, only one carrying an authorize/token request or an /oauth path.
+      # `https://` cannot match (the scheme is `http://` literally), and the
+      # localhost / loopback dev hosts are subtracted below.
+      - patterns:
+          - pattern-regex: |-
+              ['"]http://[^'"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token)[^'"]*['"]
+          - pattern-not-regex: |-
+              http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-015
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/oauth/ropc-grant.yml

@@ -0,0 +1,43 @@
+rules:
+  - id: auth.oauth.ropc-grant
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials
+      grant (`grant_type=password`). The app collects the user's password
+      and replays it to the authorization server — exactly what OAuth was
+      designed to avoid. It cannot support federation, MFA, or step-up
+      auth, and any compromise of your service exposes raw user passwords.
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or
+      `client_credentials` for machine-to-machine.
+    pattern-either:
+      # Object literal / assignment: { grant_type: 'password' } or
+      # grant_type = 'password'. The `=` alt also covers `grant_type = "password"`.
+      - pattern-regex: |-
+              grant_type\s*[:=]\s*['"]password['"]
+      # URL-encoded request body: "grant_type=password&username=…" (single,
+      # double, or template-literal string). The value is bounded so
+      # `grant_type=password_reset` and friends are not flagged.
+      - pattern-regex: |-
+              [?&'"`]grant_type=password(?:[&'"`\s]|$)
+      # URLSearchParams / FormData builders: append/set('grant_type','password').
+      - pattern-regex: |-
+              ['"]grant_type['"]\s*,\s*['"]password['"]
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-014
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/oauth/static-state.yml

@@ -0,0 +1,49 @@
+rules:
+  - id: auth.oauth.static-state
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      OAuth authorization request sends a hardcoded, constant `state`
+      value. A static `state` provides ZERO CSRF protection — the whole
+      point is an unguessable, per-request value that you store and then
+      compare on the callback. A literal that ships in your source is known
+      to everyone and identical on every request, so an attacker can forge
+      a matching callback.
+
+      Generate `state` fresh per request from a CSPRNG
+      (`crypto.randomBytes(32).toString('hex')` /
+      `crypto.getRandomValues`), persist it in the session/cookie, and
+      verify it when the provider redirects back.
+    pattern-either:
+      # Programmatic authorize build: a string-literal `state` alongside a
+      # `response_type` in the same URLSearchParams (so we know it is an
+      # authorize request, not some unrelated `state` field). A per-request
+      # value is a variable/shorthand, which is NOT a quoted literal and so
+      # does not match.
+      - patterns:
+          - pattern: 'new URLSearchParams({..., response_type: $R, ...})'
+          - pattern-either:
+              - pattern: 'new URLSearchParams({..., state: "$S", ...})'
+              - pattern: "new URLSearchParams({..., state: '$S', ...})"
+      # Inline authorize URL string literal carrying both response_type and a
+      # constant state value. A dynamic state would be a template literal
+      # (backticks) with `${...}`, which this single/double-quoted form excludes.
+      - patterns:
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*response_type=[^'"]*['"]
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*state=[A-Za-z0-9._~%-]+[^'"]*['"]
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-016
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/py/flow/oauth-credential-in-log.yml

@@ -0,0 +1,91 @@
+rules:
+  - id: auth.py.flow.oauth-credential-in-log
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      An OAuth/OIDC credential taken from the request — an authorization
+      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
+      `token`, a `client_secret`, or the raw `Authorization` header — flows
+      into a logging call (`print`, `logging.*`, or a `logger.*`). Logs are
+      written to files, shipped to aggregators (Datadog, Splunk, CloudWatch)
+      and read by people and systems that should never see live credentials. A
+      leaked authorization code or token can be replayed to impersonate the
+      user or complete the OAuth exchange (CWE-532).
+
+      Never log the raw credential. Redact or mask it before logging, log a
+      non-sensitive identifier instead (a user id, a key id), or drop the field
+      entirely.
+    # Taint mode so indirection is caught — `at = request.args.get("access_token");
+    # logger.info(at)` flags, not just the inline form. The source list is
+    # narrowed to OAuth/OIDC credential field names (and the Authorization
+    # header) via a metavariable-regex on the accessor key, so logging a benign
+    # field such as `request.args.get("page")` does not fire. Routing the value
+    # through a redaction/masking helper clears the taint.
+    mode: taint
+    pattern-sources:
+      # Credential-named request fields: request.args.get("code"),
+      # request.form["access_token"], flask.request.json.get("id_token"), …
+      - patterns:
+          - pattern-either:
+              - pattern: request.args.get($K)
+              - pattern: request.form.get($K)
+              - pattern: request.values.get($K)
+              - pattern: request.json.get($K)
+              - pattern: request.args[$K]
+              - pattern: request.form[$K]
+              - pattern: request.values[$K]
+              - pattern: request.json[$K]
+              - pattern: flask.request.args.get($K)
+              - pattern: flask.request.form.get($K)
+              - pattern: flask.request.json.get($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^["'](?:code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)["']$
+      # Raw Authorization header.
+      - patterns:
+          - pattern-either:
+              - pattern: request.headers.get($K)
+              - pattern: request.headers[$K]
+              - pattern: flask.request.headers.get($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^["']authorization["']$
+    pattern-sanitizers:
+      # Redaction / masking helpers — the value that reaches the log is no
+      # longer the live credential.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: mask_token(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: print(...)
+              - pattern: logging.info(...)
+              - pattern: logging.debug(...)
+              - pattern: logging.warning(...)
+              - pattern: logging.error(...)
+              - pattern: logging.exception(...)
+              - pattern: logging.critical(...)
+              # logger.<level>(...) — a log-named receiver with a log-level method.
+              - patterns:
+                  - pattern: $LOG.$LEVEL(...)
+                  - metavariable-regex:
+                      metavariable: $LOG
+                      regex: (?i)^.*log(?:ger)?$
+                  - metavariable-regex:
+                      metavariable: $LEVEL
+                      regex: ^(?:info|debug|warning|warn|error|exception|critical)$
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLOW-009
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-oauth-credential-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - flask
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.3
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/py/jwt/untrusted-verify-key.yml

@@ -0,0 +1,75 @@
+rules:
+  - id: auth.py.jwt.untrusted-verify-key
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the verification key or the
+      `algorithms` allowlist of `jwt.decode(...)` (PyJWT / python-jose). When
+      the attacker controls the key, they sign their own forged token and
+      supply the matching key, so every token "verifies" — a complete
+      authentication bypass. When the attacker controls `algorithms`, they can
+      downgrade verification (e.g. to `HS256` against a public key, or to
+      `none` on older libraries) and defeat the signature check (CWE-347,
+      Improper Verification of Cryptographic Signature).
+
+      The verification key and the accepted algorithms must be fixed
+      server-side. Pin `algorithms` to a constant allowlist
+      (`algorithms=["RS256"]`) and resolve the key from trusted configuration or
+      a vetted key set keyed by a validated `kid` — never from `request.args`,
+      `request.form`, `request.json`, or `request.headers`.
+    # Taint mode with the sink FOCUSED on the key / algorithms argument — never
+    # the token. The token is supposed to come from the request, so focusing on
+    # it would false-positive on every correct call; focusing on the key and the
+    # `algorithms` value fires only when the attacker controls verification
+    # itself. Routing a candidate algorithm/key through an allow-list /
+    # validation helper clears the taint. Distinct from
+    # auth.py.jwt.algorithm-confusion (HS* + an asymmetric family) and
+    # auth.py.jwt.no-algorithms (a MISSING allowlist): this is about a
+    # request-CONTROLLED key or algorithm.
+    mode: taint
+    pattern-sources:
+      - pattern: request.args.get(...)
+      - pattern: request.args.getlist(...)
+      - pattern: request.args[...]
+      - pattern: request.form.get(...)
+      - pattern: request.form[...]
+      - pattern: request.values.get(...)
+      - pattern: request.json.get(...)
+      - pattern: request.headers.get(...)
+      - pattern: request.headers[...]
+      - pattern: flask.request.args.get(...)
+      - pattern: flask.request.headers.get(...)
+    pattern-sanitizers:
+      # A candidate algorithm or key vetted against an allow-list / validator is
+      # no longer attacker-controlled when it reaches decode().
+      - pattern: is_allowed_algorithm(...)
+      - pattern: validate_algorithm(...)
+      - pattern: is_allowed_key(...)
+      - pattern: load_trusted_key(...)
+    pattern-sinks:
+      # Request input used as the verification key (positional and keyword forms).
+      - patterns:
+          - pattern-either:
+              - pattern: jwt.decode($T, $SINK)
+              - pattern: jwt.decode($T, $SINK, ...)
+              - pattern: jwt.decode($T, key=$SINK, ...)
+          - focus-metavariable: $SINK
+      # Request input used as the accepted `algorithms`.
+      - patterns:
+          - pattern: jwt.decode(..., algorithms=$SINK, ...)
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-PY-JWT-007
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-jwt-untrusted-verify-key
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - pyjwt
+        - python-jose
+      references:
+        - https://cwe.mitre.org/data/definitions/347.html
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1
+        - https://owasp.org/www-project-api-security/