oauthlint-rules 0.2.6 → 0.3.1

package/rules/go/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.go.oauth.insecure-token-endpoint
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read
+      or rewrite them and take over the flow.
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, and userinfo
+      URL (including `oauth2.Endpoint{AuthURL, TokenURL}`).
+      `http://localhost` is fine for local development and is not flagged.
+    # A string literal that targets an OAuth/OIDC endpoint over http://.
+    # Required OAuth markers keep this precise: a generic http URL is NOT
+    # flagged, only one carrying an authorize/token request or an /oauth path.
+    # `https://` cannot match (the scheme is `http://` literally), and the
+    # localhost / loopback dev hosts are subtracted below.
+    patterns:
+      - pattern-regex: |-
+          "http://[^"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token)[^"]*"
+      - pattern-not-regex: |-
+          http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-GO-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/go/oauth/ropc-grant.yml

@@ -0,0 +1,64 @@
+rules:
+  - id: auth.go.oauth.ropc-grant
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials
+      grant (`grant_type=password`). The app collects the user's password
+      and replays it to the authorization server — exactly what OAuth was
+      designed to avoid. It cannot support federation, MFA, or step-up
+      auth, and any compromise of your service exposes raw user passwords.
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or
+      `client_credentials` for machine-to-machine. With `golang.org/x/oauth2`,
+      avoid `Config.PasswordCredentialsToken` and use `AuthCodeURL` /
+      `Exchange` instead.
+    pattern-either:
+      # golang.org/x/oauth2: Config.PasswordCredentialsToken(ctx, user, pass)
+      # is the ROPC helper — its only purpose is the password grant.
+      - pattern: $C.PasswordCredentialsToken(...)
+      # url.Values builders: v.Set("grant_type", "password") /
+      # v.Add("grant_type", "password"). The value is bounded so
+      # `password_reset` and friends are not matched.
+      - pattern-regex: |-
+              "grant_type"\s*,\s*"password"
+      # url.Values / map composite literal: {"grant_type": {"password"}} or
+      # {"grant_type": "password"}.
+      - pattern-regex: |-
+              "grant_type"\s*:\s*\[?\s*\{?\s*"password"
+      # URL-encoded request body string: "grant_type=password&username=…"
+      # (double-quoted or raw backtick string). The trailing class bounds the
+      # value so only the password grant matches.
+      - pattern-regex: |-
+              [?&"`]grant_type=password(?:[&"`\s\\]|$)
+    # We flag an application sending ROPC, not the example/test code or vendored
+    # client libraries that legitimately implement the grant. Excluding these
+    # trees keeps the signal on first-party application code; a vendored copy of
+    # `golang.org/x/oauth2`, for instance, must not trip this rule.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/*_test.go"
+        - "**/*_test.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/mock*/**"
+        - "**/testdata/**"
+        - "**/vendor/**"
+        - "**/node_modules/**"
+    metadata:
+      oauthlint-rule-id: AUTH-GO-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/go/oauth/static-state.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.go.oauth.static-state
+    languages:
+      - go
+    severity: WARNING
+    message: |
+      OAuth authorization request is built with a hardcoded, constant `state`
+      value. A static `state` provides ZERO CSRF protection — the whole point
+      is an unguessable, per-request value that you store and then compare on
+      the callback. A literal that ships in your source is known to everyone
+      and identical on every request, so an attacker can forge a matching
+      callback.
+
+      Generate `state` fresh per request from a CSPRNG (e.g.
+      `crypto/rand` -> `base64.URLEncoding.EncodeToString(b)`), persist it in
+      the session/cookie, and verify it when the provider redirects back. With
+      `golang.org/x/oauth2`, pass that random value as the first argument to
+      `Config.AuthCodeURL(state, ...)`.
+    # `Config.AuthCodeURL(state, ...)` is the golang.org/x/oauth2 authorize-URL
+    # builder; its first argument is the CSRF `state`. A string LITERAL there is
+    # constant on every request and cannot provide CSRF protection. A
+    # per-request value is a variable (not a quoted literal) and does not match.
+    # The empty-string form is excluded — that is a missing state, covered
+    # elsewhere — so this fires only on a genuinely hardcoded value.
+    patterns:
+      - pattern: $C.AuthCodeURL("...", ...)
+      - pattern-not: $C.AuthCodeURL("", ...)
+    metadata:
+      oauthlint-rule-id: AUTH-GO-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/go/tls/insecure-skip-verify.yml

@@ -15,9 +15,20 @@ rules:
       To trust a private CA in development, set `RootCAs` to a `*x509.CertPool`
       loaded with that CA instead.
     # Matches only the literal `true`. `InsecureSkipVerify: false` and the
-    # field's absence are not flagged. Works for `tls.Config{...}` and
-    # `&tls.Config{...}` (the composite literal matches inside the address-of).
-    pattern: 'tls.Config{..., InsecureSkipVerify: true, ...}'
+    # field's absence are not flagged. The `pattern-inside` keeps detection
+    # scoped to a `tls.Config{...}` (and `&tls.Config{...}`) composite literal,
+    # so an unrelated struct that happens to expose an `InsecureSkipVerify`
+    # field is never matched. Narrowing the matched node to the field itself
+    # (rather than the whole literal) is what lets the autofix below rewrite
+    # just that field and leave the surrounding `...` fields untouched.
+    patterns:
+      - pattern-inside: 'tls.Config{...}'
+      - pattern: 'InsecureSkipVerify: true'
+    # Safe, deterministic autofix: flip the boolean to `false`, the secure
+    # default that restores certificate verification and fully resolves the
+    # finding. Only the `true` literal changes; every other field in the
+    # `tls.Config` is preserved verbatim.
+    fix: 'InsecureSkipVerify: false'
     metadata:
       oauthlint-rule-id: AUTH-GO-TLS-001
       oauthlint-doc-url: https://oauthlint.dev/rules/go-tls-insecure-skip-verify

package/rules/go/tls/min-version.yml

@@ -14,13 +14,22 @@ rules:
       Set `MinVersion` to at least `tls.VersionTLS12`, and ideally
       `tls.VersionTLS13`, so the handshake refuses obsolete protocols.
     # Matches the obsolete constants only. `tls.VersionTLS12` and
-    # `tls.VersionTLS13` are not flagged. Works for both `tls.Config{...}`
-    # and `&tls.Config{...}` (the composite literal matches inside `&`).
+    # `tls.VersionTLS13` are not flagged. The `pattern-inside` keeps detection
+    # scoped to a `tls.Config{...}` (and `&tls.Config{...}`) composite literal;
+    # narrowing the matched node to the `MinVersion` field itself is what lets
+    # the autofix below rewrite just that field and leave neighbours untouched.
     patterns:
-      - pattern: 'tls.Config{..., MinVersion: $V, ...}'
+      - pattern-inside: 'tls.Config{...}'
+      - pattern: 'MinVersion: $V'
       - metavariable-regex:
           metavariable: $V
           regex: ^tls\.(VersionSSL30|VersionTLS10|VersionTLS11)$
+    # Safe, deterministic autofix: raise the floor to `tls.VersionTLS12`, the
+    # lowest version RFC 8996 still permits. This is the minimal correct upgrade
+    # — it fully resolves the finding (TLS 1.2+ is no longer flagged) without
+    # presuming the stricter `tls.VersionTLS13`, which can break interop with
+    # peers that don't yet speak 1.3.
+    fix: 'MinVersion: tls.VersionTLS12'
     metadata:
       oauthlint-rule-id: AUTH-GO-TLS-002
       oauthlint-doc-url: https://oauthlint.dev/rules/go-tls-min-version

package/rules/java/cors/credentialed-wildcard.yml

@@ -0,0 +1,44 @@
+rules:
+  - id: auth.java.cors.credentialed-wildcard
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      CORS is configured to allow any origin together with credentials. A
+      wildcard origin combined with `allowCredentials = true` tells the browser
+      to send the victim's cookies and authorization headers to a response that
+      any site can read — a cross-origin account-takeover primitive (CWE-942).
+      Because browsers reject a literal `*` when credentials are allowed,
+      `addAllowedOriginPattern("*")` exists specifically to re-enable this unsafe
+      combination, so its very use is the smell.
+
+      Never pair a wildcard origin with credentials. List the exact trusted
+      origins — `setAllowedOrigins(List.of("https://app.example.com"))` with
+      `setAllowCredentials(true)` — or drop credentials if you genuinely need a
+      public, anonymous API.
+    # Annotation form: @CrossOrigin with a wildcard origin AND allowCredentials
+    # = "true" (both attribute orderings, `origins` and the `value` alias).
+    # Programmatic form: the origin-PATTERN wildcard API, which only exists to
+    # allow `*` with credentials — flagged on its own. The plain
+    # `addAllowedOrigin`/`setAllowedOrigins` wildcards are covered by
+    # auth.java.cors.allow-all and are intentionally not duplicated here.
+    pattern-either:
+      - pattern: '@CrossOrigin(..., origins = "*", ..., allowCredentials = "true", ...)'
+      - pattern: '@CrossOrigin(..., allowCredentials = "true", ..., origins = "*", ...)'
+      - pattern: '@CrossOrigin(..., value = "*", ..., allowCredentials = "true", ...)'
+      - pattern: '@CrossOrigin(..., allowCredentials = "true", ..., value = "*", ...)'
+      - pattern: $C.addAllowedOriginPattern("*")
+      - pattern: $C.setAllowedOriginPatterns($L(..., "*", ...))
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CORS-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-cors-credentialed-wildcard
+      category: security
+      cwe: CWE-942
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - spring-web
+      references:
+        - https://docs.spring.io/spring-framework/reference/web/webmvc-cors.html
+        - https://portswigger.net/web-security/cors
+        - https://cwe.mitre.org/data/definitions/942.html

package/rules/java/jwt/none-algorithm.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: auth.java.jwt.none-algorithm
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      A JWT is created or verified with the `none` algorithm, which means there
+      is no signature at all. An `alg=none` token can be forged by anyone —
+      changing the subject, roles, or expiry costs nothing because there is no
+      signature to verify (CWE-347). This is a common AI-generated mistake: the
+      "no signature" algorithm is reached for during prototyping or testing and
+      never swapped for a real signing key.
+
+      Always sign and verify with a real algorithm. With jjwt use
+      `Jwts.builder()...signWith(key)` and a keyed parser; with Auth0 java-jwt
+      use `Algorithm.HMAC256(secret)` / `Algorithm.RSA256(...)` instead of
+      `Algorithm.none()`.
+    # jjwt (io.jsonwebtoken): the SignatureAlgorithm.NONE enum constant.
+    # Auth0 java-jwt (com.auth0.jwt): the Algorithm.none() factory.
+    pattern-either:
+      - pattern: io.jsonwebtoken.SignatureAlgorithm.NONE
+      - pattern: SignatureAlgorithm.NONE
+      - pattern: com.auth0.jwt.algorithms.Algorithm.none()
+      - pattern: Algorithm.none()
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-JWT-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-jwt-none-algorithm
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - jjwt
+        - java-jwt
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc8725#section-2.1
+        - https://cwe.mitre.org/data/definitions/347.html

package/rules/java/jwt/untrusted-verify-key.yml

@@ -0,0 +1,54 @@
+rules:
+  - id: auth.java.jwt.untrusted-verify-key
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the JWT verification key. When the
+      attacker controls the key, they sign their own forged token and supply the
+      matching key, so every token "verifies" — a complete authentication bypass
+      (CWE-347, Improper Verification of Cryptographic Signature).
+
+      The verification key must be fixed server-side. Resolve it from trusted
+      configuration, a keystore, or a vetted key set keyed by a validated `kid`
+      — never from `request.getParameter(...)` / `request.getHeader(...)` or a
+      `@RequestParam` / `@RequestHeader` value.
+    # Taint mode with the sink FOCUSED on the key argument — never the token. The
+    # token is supposed to come from the request, so focusing on it would
+    # false-positive on every correct call; focusing on the key fires only when
+    # the attacker controls verification itself. Sources are the servlet request
+    # accessors that return raw client input. A key fetched from a keystore
+    # (`KeyStore.getKey(...)`) clears the taint.
+    mode: taint
+    pattern-sources:
+      - pattern: $REQ.getParameter(...)
+      - pattern: $REQ.getParameterValues(...)
+      - pattern: $REQ.getHeader(...)
+      - pattern: $REQ.getHeaders(...)
+    pattern-sanitizers:
+      - pattern: $KS.getKey(...)
+    pattern-sinks:
+      # jjwt: the signing/verification key passed to the parser.
+      - patterns:
+          - pattern-either:
+              - pattern: $P.setSigningKey($SINK)
+              - pattern: $P.verifyWith($SINK)
+          - focus-metavariable: $SINK
+      # nimbus-jose-jwt: the HMAC secret handed to the verifier.
+      - patterns:
+          - pattern: new MACVerifier($SINK)
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-JWT-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-jwt-untrusted-verify-key
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - jjwt
+        - nimbus-jose-jwt
+      references:
+        - https://cwe.mitre.org/data/definitions/347.html
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1
+        - https://owasp.org/www-project-api-security/

package/rules/java/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.java.oauth.insecure-token-endpoint
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read or
+      rewrite them and take over the flow (CWE-319).
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, and userinfo URL.
+      `http://localhost` and loopback addresses are fine for local development
+      and are not flagged.
+    # A string literal that targets an OAuth/OIDC endpoint over http://. Required
+    # OAuth markers keep this precise: a generic http URL is NOT flagged, only
+    # one carrying an authorize/token request or an /oauth path. `https://`
+    # cannot match (the scheme is literal), and localhost / loopback dev hosts
+    # are subtracted.
+    patterns:
+      - pattern-regex: |-
+          "http://[^"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token)[^"]*"
+      - pattern-not-regex: |-
+          http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/java/oauth/ropc-grant.yml

@@ -0,0 +1,45 @@
+rules:
+  - id: auth.java.oauth.ropc-grant
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials grant
+      (`grant_type=password`). The application collects the user's password and
+      replays it to the authorization server — exactly what OAuth was designed
+      to avoid. It cannot support federation, MFA, or step-up auth, and any
+      compromise of your service exposes raw user passwords (CWE-522).
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or `client_credentials`
+      for machine-to-machine.
+    # Match `grant_type=password` only where it is a token-request body, so an
+    # unrelated `grant_type` variable is never flagged.
+    #   - URL-encoded form string body: "grant_type=password&username=…". The
+    #     value is bounded so `grant_type=password_reset` is NOT matched.
+    #   - Form builders that pair the key and value as two string-literal args:
+    #     OkHttp `FormBody.Builder().add("grant_type", "password")`, Spring
+    #     `BodyInserters.fromFormData("grant_type", "password")` /
+    #     `MultiValueMap.add(...)`, Apache `new BasicNameValuePair(...)`.
+    pattern-either:
+      - pattern-regex: |-
+          [?&"']grant_type=password(?:["'&\s]|$)
+      - pattern-regex: |-
+          ["']grant_type["']\s*,\s*["']password["']
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - spring-web
+        - okhttp
+        - apache-httpclient
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/java/oauth/static-state.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.java.oauth.static-state
+    languages:
+      - java
+    severity: WARNING
+    message: |
+      OAuth authorization request sends a hardcoded, constant `state` value. A
+      static `state` provides ZERO CSRF protection — the whole point is an
+      unguessable, per-request value that you store and then compare on the
+      callback. A literal that ships in your source is known to everyone and
+      identical on every request, so an attacker can forge a matching callback
+      (CWE-330).
+
+      Generate `state` fresh per request from a CSPRNG (`new SecureRandom()` /
+      `Base64.getUrlEncoder().encodeToString(randomBytes)`), persist it in the
+      session, and verify it when the provider redirects back.
+    # An inline authorize URL string literal that carries BOTH a `response_type`
+    # (so we know it is an authorize request, not some unrelated `state` field)
+    # AND a constant `state=` value. A per-request value is built by
+    # concatenation — `"…&state=" + state` — whose literal ends right after
+    # `state=`, so the value-character class below cannot match it.
+    patterns:
+      - pattern-regex: |-
+          "https?://[^"\s]+\?[^"]*response_type=[^"]*"
+      - pattern-regex: |-
+          "https?://[^"\s]+\?[^"]*state=[A-Za-z0-9._~%-]+[^"]*"
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/java/web/permit-all-actuator.yml

@@ -0,0 +1,43 @@
+rules:
+  - id: auth.java.web.permit-all-actuator
+    languages:
+      - java
+    severity: WARNING
+    message: |
+      Spring Security grants `permitAll()` to a sensitive management path. Spring
+      Boot Actuator and similar diagnostic endpoints expose health, environment,
+      configuration, thread dumps, and heap dumps — opening them to anonymous
+      access leaks secrets and internal state and can enable remote code
+      execution (CWE-862, broken access control). This is a common AI-generated
+      mistake: the management path is opened to "fix" a probe or scrape and the
+      intended authentication is never added.
+
+      Require authentication for management endpoints — e.g.
+      `requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ADMIN")` — and
+      expose only `/actuator/health` (and `/info`) publicly if you must.
+    # Flag permitAll() on a matcher whose path literal targets a management /
+    # diagnostics surface (actuator, jolokia, heap/thread dumps, internal).
+    # Ordinary application matchers (e.g. "/public/**", "/login") are not
+    # flagged. Covers the Spring Security 6 `requestMatchers` and the legacy
+    # `antMatchers` / `mvcMatchers`.
+    patterns:
+      - pattern-either:
+          - pattern: $X.requestMatchers($P).permitAll()
+          - pattern: $X.antMatchers($P).permitAll()
+          - pattern: $X.mvcMatchers($P).permitAll()
+      - metavariable-regex:
+          metavariable: $P
+          regex: (?s).*/(?:actuator|jolokia|heapdump|threaddump|internal)\b.*
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-WEB-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-web-permit-all-actuator
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - spring-security
+        - spring-boot-actuator
+      references:
+        - https://docs.spring.io/spring-boot/reference/actuator/endpoints.html
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/jwt/ignore-expiration.yml

@@ -18,17 +18,27 @@ rules:
     # pass `ignoreExpiration: true`; `verify(...)` without that option, and
     # `ignoreExpiration: false`, are never matched. We also support the
     # destructured import `import { verify } from 'jsonwebtoken'`, scoped to that
-    # import so an unrelated `verify()` is safe. The options object is matched
-    # with `{ ..., ignoreExpiration: true, ... }` so the flag is caught
-    # regardless of which other options (algorithms, maxAge, audience, ...)
-    # appear alongside it.
-    pattern-either:
-      - pattern: 'jwt.verify($T, $K, { ..., ignoreExpiration: true, ... })'
-      - patterns:
-          - pattern-inside: |
-              import { ..., verify, ... } from 'jsonwebtoken'
-              ...
-          - pattern: 'verify($T, $K, { ..., ignoreExpiration: true, ... })'
+    # import so an unrelated `verify()` is safe. The verify call is matched with
+    # `pattern-inside` (any options object), and the matched node is narrowed to
+    # the `ignoreExpiration: true` property itself — this keeps detection
+    # identical (the flag is still caught regardless of which other options
+    # appear alongside it) while letting the autofix below rewrite just that
+    # property and leave every sibling option untouched.
+    patterns:
+      - pattern-either:
+          - pattern-inside: 'jwt.verify($T, $K, {...})'
+          - patterns:
+              - pattern-inside: |
+                  import { ..., verify, ... } from 'jsonwebtoken'
+                  ...
+              - pattern-inside: 'verify($T, $K, {...})'
+      - pattern: 'ignoreExpiration: true'
+    # Safe, deterministic autofix: flip the disabled check back on. `false` is the
+    # secure value — it is the library default (expiry enforced) and the exact
+    # value the rule treats as compliant — so the rewrite fully resolves the
+    # finding. The match is narrowed to the property, so `ignoreExpiration: true`
+    # becomes `ignoreExpiration: false` with the rest of the options object intact.
+    fix: 'ignoreExpiration: false'
     metadata:
       oauthlint-rule-id: AUTH-JWT-011
       oauthlint-doc-url: https://oauthlint.dev/rules/jwt-ignore-expiration

package/rules/jwt/untrusted-verify-key.yml

@@ -0,0 +1,77 @@
+rules:
+  - id: auth.jwt.untrusted-verify-key
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the verification key or the
+      `algorithms` allowlist of `jwt.verify(...)`. When the attacker controls
+      the key, they sign their own forged token and supply the matching key,
+      so every token "verifies" — a complete authentication bypass. When the
+      attacker controls `algorithms`, they can downgrade verification (e.g. to
+      `HS256` against a public key, or to `none` on older libraries) and defeat
+      the signature check (CWE-347, Improper Verification of Cryptographic
+      Signature).
+
+      The verification key and the accepted algorithms must be fixed
+      server-side. Pin `algorithms` to a constant allowlist
+      (`{ algorithms: ['RS256'] }`) and resolve the key from trusted
+      configuration or a vetted key set keyed by a validated `kid` — never from
+      `req.query` / `req.body` / `req.params` / `req.headers`.
+    # Taint mode with the sink FOCUSED on the key / algorithms argument — never
+    # the token. The token is supposed to come from the request, so focusing on
+    # it would false-positive on every correct call; focusing on the key and the
+    # `algorithms` value fires only when the attacker controls verification
+    # itself. Routing a candidate algorithm/key through an allow-list /
+    # validation helper clears the taint. Distinct from
+    # auth.jwt.algorithm-confusion (HS* + a PEM public key) and
+    # auth.jwt.no-algorithms-allowlist (a MISSING allowlist): this is about a
+    # request-CONTROLLED key or algorithm.
+    mode: taint
+    pattern-sources:
+      - pattern: $REQ.query
+      - pattern: $REQ.params
+      - pattern: $REQ.body
+      - pattern: $REQ.headers
+      - pattern: $REQ.query.$X
+      - pattern: $REQ.params.$X
+      - pattern: $REQ.body.$X
+      - pattern: $REQ.headers.$X
+      - pattern: $REQ.query[$K]
+      - pattern: $REQ.params[$K]
+      - pattern: $REQ.body[$K]
+      - pattern: $REQ.headers[$K]
+    pattern-sanitizers:
+      # A candidate algorithm or key vetted against an allow-list / validator is
+      # no longer attacker-controlled when it reaches verify().
+      - pattern: isAllowedAlgorithm(...)
+      - pattern: validateAlgorithm(...)
+      - pattern: isAllowedKey(...)
+      - pattern: $ALLOW.includes(...)
+      - pattern: $ALLOW.has(...)
+      - pattern: $ALLOW.indexOf(...)
+    pattern-sinks:
+      # Request input used as the verification key (2- and 3-argument forms).
+      - patterns:
+          - pattern-either:
+              - pattern: jwt.verify($T, $SINK)
+              - pattern: jwt.verify($T, $SINK, $OPTS)
+          - focus-metavariable: $SINK
+      # Request input used as the accepted `algorithms`.
+      - patterns:
+          - pattern: 'jwt.verify($T, $KEY, {..., algorithms: $SINK, ...})'
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-JWT-012
+      oauthlint-doc-url: https://oauthlint.dev/rules/jwt-untrusted-verify-key
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - jsonwebtoken
+      references:
+        - https://cwe.mitre.org/data/definitions/347.html
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1
+        - https://owasp.org/www-project-api-security/