oauthlint-rules 0.2.6 → 0.3.0

package/rules/py/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,40 @@
+rules:
+  - id: auth.py.oauth.insecure-token-endpoint
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read
+      or rewrite them and take over the flow.
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, userinfo, and
+      `.well-known` discovery URL. `http://localhost` and loopback addresses
+      are fine for local development and are not flagged.
+    # A string literal (including an f-string) that targets an OAuth/OIDC
+    # endpoint over http://. Required OAuth markers keep this precise: a generic
+    # http URL is NOT flagged, only one carrying an authorize/token request or an
+    # /oauth, /connect/token, or /.well-known path. `https://` cannot match (the
+    # scheme is the literal `http://`), and the localhost / loopback dev hosts
+    # are subtracted below.
+    patterns:
+      - pattern-regex: |-
+              ['"]http://[^'"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token|/\.well-known/)[^'"]*['"]
+      - pattern-not-regex: |-
+              http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/py/oauth/insecure-transport-env.yml

@@ -0,0 +1,43 @@
+rules:
+  - id: auth.py.oauth.insecure-transport-env
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      `OAUTHLIB_INSECURE_TRANSPORT` is being set, which disables oauthlib's
+      HTTPS requirement for OAuth flows (`requests-oauthlib`, Authlib's
+      requests integration, Django OAuth Toolkit). oauthlib raises
+      `InsecureTransportError` to stop you exchanging codes and tokens over
+      cleartext; setting this variable silences that guard, so authorization
+      codes, `client_secret`, and access/refresh tokens travel over plain
+      `http://` where a network attacker can read or rewrite them (CWE-319).
+
+      Remove this assignment and serve every OAuth endpoint over `https://`.
+      For local development use a loopback HTTPS listener or a tunnel rather
+      than disabling transport security in code that can ship to production.
+    # Matches only an ASSIGNMENT (or setdefault/putenv) of the
+    # OAUTHLIB_INSECURE_TRANSPORT key. Merely reading it
+    # (`os.environ.get("OAUTHLIB_INSECURE_TRANSPORT")`) is not flagged, and other
+    # environment keys are untouched. Semgrep normalises quote style, so the
+    # single- and double-quoted spellings are both covered.
+    pattern-either:
+      - pattern: os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = ...
+      - pattern: os.environ.setdefault("OAUTHLIB_INSECURE_TRANSPORT", ...)
+      - pattern: os.putenv("OAUTHLIB_INSECURE_TRANSPORT", ...)
+      - pattern: environ["OAUTHLIB_INSECURE_TRANSPORT"] = ...
+      - pattern: environ.setdefault("OAUTHLIB_INSECURE_TRANSPORT", ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-insecure-transport-env
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - oauthlib
+        - requests-oauthlib
+        - authlib
+      references:
+        - https://requests-oauthlib.readthedocs.io/en/latest/oauth2_workflow.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/py/oauth/ropc-grant.yml

@@ -0,0 +1,50 @@
+rules:
+  - id: auth.py.oauth.ropc-grant
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials
+      grant (`grant_type=password`). The app collects the user's password
+      and replays it to the authorization server — exactly what OAuth was
+      designed to avoid. It cannot support federation, MFA, or step-up
+      auth, and any compromise of your service exposes raw user passwords.
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or
+      `client_credentials` for machine-to-machine. In Python this covers a
+      `requests`/`httpx`/`urllib` body, an OAuth client call, or a
+      URL-encoded body string.
+    # Regex-based so it is library-agnostic across requests, httpx, urllib and
+    # OAuth clients. The `password` value is matched as an exact quoted literal
+    # (dict / kwarg form) or bounded token (URL-encoded form), so
+    # `grant_type=password_reset` and `grant_type=client_credentials` never
+    # fire, and a dynamic `grant_type=grant` variable is not a literal and is
+    # not flagged.
+    pattern-either:
+      # Dict entry `"grant_type": "password"` or keyword `grant_type="password"`.
+      # The optional quote after the key covers the dict form's closing `"`.
+      - pattern-regex: |-
+              grant_type['"]?\s*[:=]\s*['"]password['"]
+      # URL-encoded request body: "grant_type=password&username=…". The value is
+      # bounded so `grant_type=password_reset` is not flagged.
+      - pattern-regex: |-
+              [?&'"]grant_type=password(?:[&'"\s]|$)
+      # Tuple/list pair form: ("grant_type", "password").
+      - pattern-regex: |-
+              ['"]grant_type['"]\s*,\s*['"]password['"]
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - requests
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/py/oauth/static-state.yml

@@ -0,0 +1,45 @@
+rules:
+  - id: auth.py.oauth.static-state
+    languages:
+      - python
+    severity: WARNING
+    message: |
+      OAuth authorization request sends a hardcoded, constant `state`
+      value. A static `state` provides ZERO CSRF protection — the whole
+      point is an unguessable, per-request value that you store and then
+      compare on the callback. A literal that ships in your source is known
+      to everyone and identical on every request, so an attacker can forge
+      a matching callback.
+
+      Generate `state` fresh per request from a CSPRNG
+      (`secrets.token_urlsafe(32)`), persist it in the session, and verify
+      it when the provider redirects back.
+    pattern-either:
+      # Authorize parameter dict carrying a `response_type` (so we know it is an
+      # authorize request, not some unrelated `state` field) AND a string-LITERAL
+      # `state`. A per-request value is a variable or a function call, which is
+      # not a quoted literal and so does not match.
+      - patterns:
+          - pattern: '{..., "response_type": ..., ...}'
+          - pattern-either:
+              - pattern: '{..., "state": "$S", ...}'
+      # Inline authorize URL string literal carrying both response_type and a
+      # constant state value. A dynamic state would be an f-string with `{state}`,
+      # whose `{` is excluded from the value character class below.
+      - patterns:
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*response_type=[^'"]*['"]
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*state=[A-Za-z0-9._~%-]+[^'"]*['"]
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/py/oauth/token-request-verify-disabled.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.py.oauth.token-request-verify-disabled
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      An OAuth client fetches or refreshes a token with TLS certificate
+      verification disabled (`verify=False`). The token request carries the
+      `client_secret`, the authorization `code`, and the issued access/refresh
+      tokens; with verification off, an attacker who can intercept the
+      connection presents any certificate and reads or tampers with them — a
+      classic man-in-the-middle on the most sensitive call in the flow
+      (CWE-295).
+
+      Never pass `verify=False` to `fetch_token` / `refresh_token` /
+      `fetch_access_token` (Authlib, requests-oauthlib). Leave verification on
+      (the default) so the system CA bundle is used, or point `verify` at a CA
+      bundle path for a private CA.
+    # Scoped to OAuth client token methods (Authlib OAuth1/2 sessions,
+    # requests-oauthlib) and the literal `verify=False`. `verify=True` and
+    # `verify="/path/ca.pem"` are not flagged. This is distinct from
+    # auth.py.flow.requests-verify-disabled, which covers the `requests` HTTP
+    # verbs (`get`/`post`/…); here the sink is the OAuth token-exchange call.
+    pattern-either:
+      - pattern: $C.fetch_token(..., verify=False, ...)
+      - pattern: $C.refresh_token(..., verify=False, ...)
+      - pattern: $C.fetch_access_token(..., verify=False, ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-token-request-verify-disabled
+      category: security
+      cwe: CWE-295
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - authlib
+        - requests-oauthlib
+      references:
+        - https://docs.authlib.org/en/latest/client/oauth2.html
+        - https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification
+        - https://cwe.mitre.org/data/definitions/295.html

package/rules/rust/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.rust.oauth.insecure-token-endpoint
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read
+      or rewrite them and take over the flow.
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, and userinfo URL
+      (including the `oauth2` crate's `AuthUrl` / `TokenUrl`).
+      `http://localhost` is fine for local development and is not flagged.
+    # A string literal that targets an OAuth/OIDC endpoint over http://.
+    # Required OAuth markers keep this precise: a generic http URL is NOT
+    # flagged, only one carrying an authorize/token request or an /oauth path.
+    # `https://` cannot match, and the localhost / loopback dev hosts are
+    # subtracted below.
+    patterns:
+      - pattern-regex: |-
+          "http://[^"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token)[^"]*"
+      - pattern-not-regex: |-
+          http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/rust/oauth/ropc-grant.yml

@@ -0,0 +1,40 @@
+rules:
+  - id: auth.rust.oauth.ropc-grant
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials
+      grant (`grant_type=password`). The app collects the user's password
+      and replays it to the authorization server — exactly what OAuth was
+      designed to avoid. It cannot support federation, MFA, or step-up
+      auth, and any compromise of your service exposes raw user passwords.
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or
+      `client_credentials` for machine-to-machine. With the `oauth2` crate,
+      use `authorize_url` / `exchange_code` instead of `exchange_password`.
+    pattern-either:
+      # oauth2 crate ROPC helper — its only purpose is the password grant.
+      - pattern: $C.exchange_password(...)
+      # reqwest / hand-built form pair: ("grant_type", "password"). The value
+      # is bounded so `password_reset` and friends are not matched.
+      - pattern-regex: |-
+              "grant_type"\s*,\s*"password"
+      # URL-encoded request body string: "grant_type=password&username=…".
+      - pattern-regex: |-
+              [?&"]grant_type=password(?:[&"\s\\]|$)
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/rust/oauth/static-state.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.rust.oauth.static-state
+    languages:
+      - rust
+    severity: WARNING
+    message: |
+      OAuth authorization request is built with a hardcoded, constant `state`
+      value (`CsrfToken::new("literal")`). A static `state` provides ZERO CSRF
+      protection — the whole point is an unguessable, per-request value that
+      you store and then compare on the callback. A literal that ships in your
+      source is known to everyone and identical on every request, so an
+      attacker can forge a matching callback.
+
+      Use `CsrfToken::new_random` (the `oauth2` crate's CSPRNG-backed
+      generator), pass it to `authorize_url`, persist it in the session, and
+      verify it when the provider redirects back.
+    # `CsrfToken::new` with a STRING LITERAL is a constant state baked into the
+    # source. The four conversion forms below match only when the literal is the
+    # direct argument, so `CsrfToken::new(generate())` or a variable is never
+    # flagged. `CsrfToken::new_random()` is a different method and is not
+    # matched.
+    pattern-either:
+      - pattern: CsrfToken::new("...".to_string())
+      - pattern: CsrfToken::new("...".to_owned())
+      - pattern: CsrfToken::new("...".into())
+      - pattern: CsrfToken::new(String::from("..."))
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html