oauthlint-rules 0.2.6 → 0.3.1

package/rules/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.oauth.insecure-token-endpoint
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read
+      or rewrite them and take over the flow.
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, and userinfo
+      URL. `http://localhost` is fine for local development and is not
+      flagged.
+    pattern-either:
+      # A string literal that targets an OAuth/OIDC endpoint over http://.
+      # Required OAuth markers keep this precise: a generic http URL is NOT
+      # flagged, only one carrying an authorize/token request or an /oauth path.
+      # `https://` cannot match (the scheme is `http://` literally), and the
+      # localhost / loopback dev hosts are subtracted below.
+      - patterns:
+          - pattern-regex: |-
+              ['"]http://[^'"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token)[^'"]*['"]
+          - pattern-not-regex: |-
+              http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-015
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/oauth/ropc-grant.yml

@@ -0,0 +1,48 @@
+rules:
+  - id: auth.oauth.ropc-grant
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials
+      grant (`grant_type=password`). The app collects the user's password
+      and replays it to the authorization server — exactly what OAuth was
+      designed to avoid. It cannot support federation, MFA, or step-up
+      auth, and any compromise of your service exposes raw user passwords.
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or
+      `client_credentials` for machine-to-machine.
+    pattern-either:
+      # Object literal entry: `{ grant_type: 'password' }` (bare or quoted key).
+      # The colon anchors it to a property, not a bare variable assignment.
+      - pattern-regex: |-
+              grant_type\s*:\s*['"]password['"]
+      # Property write that builds a request body: `body.grant_type = 'password'`.
+      # The leading `.` requires a member assignment, so a library's own bare
+      # local `grant_type = 'password'` (an internal constant) is NOT flagged.
+      - pattern-regex: |-
+              \.grant_type\s*=\s*['"]password['"]
+      # URL-encoded request body: "grant_type=password&username=…" (single,
+      # double, or template-literal string). The value is bounded so
+      # `grant_type=password_reset` and friends are not flagged.
+      - pattern-regex: |-
+              [?&'"`]grant_type=password(?:[&'"`\s]|$)
+      # URLSearchParams / FormData builders: append/set('grant_type','password').
+      - pattern-regex: |-
+              ['"]grant_type['"]\s*,\s*['"]password['"]
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-014
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/oauth/static-state.yml

@@ -0,0 +1,49 @@
+rules:
+  - id: auth.oauth.static-state
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      OAuth authorization request sends a hardcoded, constant `state`
+      value. A static `state` provides ZERO CSRF protection — the whole
+      point is an unguessable, per-request value that you store and then
+      compare on the callback. A literal that ships in your source is known
+      to everyone and identical on every request, so an attacker can forge
+      a matching callback.
+
+      Generate `state` fresh per request from a CSPRNG
+      (`crypto.randomBytes(32).toString('hex')` /
+      `crypto.getRandomValues`), persist it in the session/cookie, and
+      verify it when the provider redirects back.
+    pattern-either:
+      # Programmatic authorize build: a string-literal `state` alongside a
+      # `response_type` in the same URLSearchParams (so we know it is an
+      # authorize request, not some unrelated `state` field). A per-request
+      # value is a variable/shorthand, which is NOT a quoted literal and so
+      # does not match.
+      - patterns:
+          - pattern: 'new URLSearchParams({..., response_type: $R, ...})'
+          - pattern-either:
+              - pattern: 'new URLSearchParams({..., state: "$S", ...})'
+              - pattern: "new URLSearchParams({..., state: '$S', ...})"
+      # Inline authorize URL string literal carrying both response_type and a
+      # constant state value. A dynamic state would be a template literal
+      # (backticks) with `${...}`, which this single/double-quoted form excludes.
+      - patterns:
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*response_type=[^'"]*['"]
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*state=[A-Za-z0-9._~%-]+[^'"]*['"]
+    metadata:
+      oauthlint-rule-id: AUTH-OAUTH-016
+      oauthlint-doc-url: https://oauthlint.dev/rules/oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/py/flow/oauth-credential-in-log.yml

@@ -0,0 +1,91 @@
+rules:
+  - id: auth.py.flow.oauth-credential-in-log
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      An OAuth/OIDC credential taken from the request — an authorization
+      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
+      `token`, a `client_secret`, or the raw `Authorization` header — flows
+      into a logging call (`print`, `logging.*`, or a `logger.*`). Logs are
+      written to files, shipped to aggregators (Datadog, Splunk, CloudWatch)
+      and read by people and systems that should never see live credentials. A
+      leaked authorization code or token can be replayed to impersonate the
+      user or complete the OAuth exchange (CWE-532).
+
+      Never log the raw credential. Redact or mask it before logging, log a
+      non-sensitive identifier instead (a user id, a key id), or drop the field
+      entirely.
+    # Taint mode so indirection is caught — `at = request.args.get("access_token");
+    # logger.info(at)` flags, not just the inline form. The source list is
+    # narrowed to OAuth/OIDC credential field names (and the Authorization
+    # header) via a metavariable-regex on the accessor key, so logging a benign
+    # field such as `request.args.get("page")` does not fire. Routing the value
+    # through a redaction/masking helper clears the taint.
+    mode: taint
+    pattern-sources:
+      # Credential-named request fields: request.args.get("code"),
+      # request.form["access_token"], flask.request.json.get("id_token"), …
+      - patterns:
+          - pattern-either:
+              - pattern: request.args.get($K)
+              - pattern: request.form.get($K)
+              - pattern: request.values.get($K)
+              - pattern: request.json.get($K)
+              - pattern: request.args[$K]
+              - pattern: request.form[$K]
+              - pattern: request.values[$K]
+              - pattern: request.json[$K]
+              - pattern: flask.request.args.get($K)
+              - pattern: flask.request.form.get($K)
+              - pattern: flask.request.json.get($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^["'](?:code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)["']$
+      # Raw Authorization header.
+      - patterns:
+          - pattern-either:
+              - pattern: request.headers.get($K)
+              - pattern: request.headers[$K]
+              - pattern: flask.request.headers.get($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^["']authorization["']$
+    pattern-sanitizers:
+      # Redaction / masking helpers — the value that reaches the log is no
+      # longer the live credential.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: mask_token(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: print(...)
+              - pattern: logging.info(...)
+              - pattern: logging.debug(...)
+              - pattern: logging.warning(...)
+              - pattern: logging.error(...)
+              - pattern: logging.exception(...)
+              - pattern: logging.critical(...)
+              # logger.<level>(...) — a log-named receiver with a log-level method.
+              - patterns:
+                  - pattern: $LOG.$LEVEL(...)
+                  - metavariable-regex:
+                      metavariable: $LOG
+                      regex: (?i)^.*log(?:ger)?$
+                  - metavariable-regex:
+                      metavariable: $LEVEL
+                      regex: ^(?:info|debug|warning|warn|error|exception|critical)$
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLOW-009
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-oauth-credential-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - flask
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.3
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/py/jwt/untrusted-verify-key.yml

@@ -0,0 +1,75 @@
+rules:
+  - id: auth.py.jwt.untrusted-verify-key
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the verification key or the
+      `algorithms` allowlist of `jwt.decode(...)` (PyJWT / python-jose). When
+      the attacker controls the key, they sign their own forged token and
+      supply the matching key, so every token "verifies" — a complete
+      authentication bypass. When the attacker controls `algorithms`, they can
+      downgrade verification (e.g. to `HS256` against a public key, or to
+      `none` on older libraries) and defeat the signature check (CWE-347,
+      Improper Verification of Cryptographic Signature).
+
+      The verification key and the accepted algorithms must be fixed
+      server-side. Pin `algorithms` to a constant allowlist
+      (`algorithms=["RS256"]`) and resolve the key from trusted configuration or
+      a vetted key set keyed by a validated `kid` — never from `request.args`,
+      `request.form`, `request.json`, or `request.headers`.
+    # Taint mode with the sink FOCUSED on the key / algorithms argument — never
+    # the token. The token is supposed to come from the request, so focusing on
+    # it would false-positive on every correct call; focusing on the key and the
+    # `algorithms` value fires only when the attacker controls verification
+    # itself. Routing a candidate algorithm/key through an allow-list /
+    # validation helper clears the taint. Distinct from
+    # auth.py.jwt.algorithm-confusion (HS* + an asymmetric family) and
+    # auth.py.jwt.no-algorithms (a MISSING allowlist): this is about a
+    # request-CONTROLLED key or algorithm.
+    mode: taint
+    pattern-sources:
+      - pattern: request.args.get(...)
+      - pattern: request.args.getlist(...)
+      - pattern: request.args[...]
+      - pattern: request.form.get(...)
+      - pattern: request.form[...]
+      - pattern: request.values.get(...)
+      - pattern: request.json.get(...)
+      - pattern: request.headers.get(...)
+      - pattern: request.headers[...]
+      - pattern: flask.request.args.get(...)
+      - pattern: flask.request.headers.get(...)
+    pattern-sanitizers:
+      # A candidate algorithm or key vetted against an allow-list / validator is
+      # no longer attacker-controlled when it reaches decode().
+      - pattern: is_allowed_algorithm(...)
+      - pattern: validate_algorithm(...)
+      - pattern: is_allowed_key(...)
+      - pattern: load_trusted_key(...)
+    pattern-sinks:
+      # Request input used as the verification key (positional and keyword forms).
+      - patterns:
+          - pattern-either:
+              - pattern: jwt.decode($T, $SINK)
+              - pattern: jwt.decode($T, $SINK, ...)
+              - pattern: jwt.decode($T, key=$SINK, ...)
+          - focus-metavariable: $SINK
+      # Request input used as the accepted `algorithms`.
+      - patterns:
+          - pattern: jwt.decode(..., algorithms=$SINK, ...)
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-PY-JWT-007
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-jwt-untrusted-verify-key
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - pyjwt
+        - python-jose
+      references:
+        - https://cwe.mitre.org/data/definitions/347.html
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1
+        - https://owasp.org/www-project-api-security/

package/rules/py/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,40 @@
+rules:
+  - id: auth.py.oauth.insecure-token-endpoint
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read
+      or rewrite them and take over the flow.
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, userinfo, and
+      `.well-known` discovery URL. `http://localhost` and loopback addresses
+      are fine for local development and are not flagged.
+    # A string literal (including an f-string) that targets an OAuth/OIDC
+    # endpoint over http://. Required OAuth markers keep this precise: a generic
+    # http URL is NOT flagged, only one carrying an authorize/token request or an
+    # /oauth, /connect/token, or /.well-known path. `https://` cannot match (the
+    # scheme is the literal `http://`), and the localhost / loopback dev hosts
+    # are subtracted below.
+    patterns:
+      - pattern-regex: |-
+              ['"]http://[^'"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token|/\.well-known/)[^'"]*['"]
+      - pattern-not-regex: |-
+              http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/py/oauth/insecure-transport-env.yml

@@ -0,0 +1,43 @@
+rules:
+  - id: auth.py.oauth.insecure-transport-env
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      `OAUTHLIB_INSECURE_TRANSPORT` is being set, which disables oauthlib's
+      HTTPS requirement for OAuth flows (`requests-oauthlib`, Authlib's
+      requests integration, Django OAuth Toolkit). oauthlib raises
+      `InsecureTransportError` to stop you exchanging codes and tokens over
+      cleartext; setting this variable silences that guard, so authorization
+      codes, `client_secret`, and access/refresh tokens travel over plain
+      `http://` where a network attacker can read or rewrite them (CWE-319).
+
+      Remove this assignment and serve every OAuth endpoint over `https://`.
+      For local development use a loopback HTTPS listener or a tunnel rather
+      than disabling transport security in code that can ship to production.
+    # Matches only an ASSIGNMENT (or setdefault/putenv) of the
+    # OAUTHLIB_INSECURE_TRANSPORT key. Merely reading it
+    # (`os.environ.get("OAUTHLIB_INSECURE_TRANSPORT")`) is not flagged, and other
+    # environment keys are untouched. Semgrep normalises quote style, so the
+    # single- and double-quoted spellings are both covered.
+    pattern-either:
+      - pattern: os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = ...
+      - pattern: os.environ.setdefault("OAUTHLIB_INSECURE_TRANSPORT", ...)
+      - pattern: os.putenv("OAUTHLIB_INSECURE_TRANSPORT", ...)
+      - pattern: environ["OAUTHLIB_INSECURE_TRANSPORT"] = ...
+      - pattern: environ.setdefault("OAUTHLIB_INSECURE_TRANSPORT", ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-insecure-transport-env
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - oauthlib
+        - requests-oauthlib
+        - authlib
+      references:
+        - https://requests-oauthlib.readthedocs.io/en/latest/oauth2_workflow.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/py/oauth/ropc-grant.yml

@@ -0,0 +1,58 @@
+rules:
+  - id: auth.py.oauth.ropc-grant
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials
+      grant (`grant_type=password`). The app collects the user's password
+      and replays it to the authorization server — exactly what OAuth was
+      designed to avoid. It cannot support federation, MFA, or step-up
+      auth, and any compromise of your service exposes raw user passwords.
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or
+      `client_credentials` for machine-to-machine. In Python this covers a
+      `requests`/`httpx`/`urllib` body, an OAuth client call, or a
+      URL-encoded body string.
+    # Regex-based so it is library-agnostic across requests, httpx, urllib and
+    # OAuth clients. The `password` value is matched as an exact quoted literal
+    # (dict / kwarg form) or bounded token (URL-encoded form), so
+    # `grant_type=password_reset` and `grant_type=client_credentials` never
+    # fire, and a dynamic `grant_type=grant` variable is not a literal and is
+    # not flagged. Each form anchors `grant_type` to a request-parameter
+    # position (dict key, call keyword, query string, or pair) so a library's
+    # own bare local assignment — `grant_type = "password"`, as in Authlib's
+    # `_guess_grant_type` — is NOT treated as an application sending the grant.
+    pattern-either:
+      # Dict / mapping entry: `{"grant_type": "password"}`. The key is a quoted
+      # literal followed by a colon, which a bare variable assignment is not.
+      - pattern-regex: |-
+              ['"]grant_type['"]\s*:\s*['"]password['"]
+      # Call keyword argument: `fetch_token(..., grant_type="password")`. The
+      # leading `(` or `,` anchors it to an argument list, so a top-level
+      # statement `grant_type = "password"` (library internal) does not match.
+      - pattern-regex: |-
+              [(,]\s*grant_type\s*=\s*['"]password['"]
+      # URL-encoded request body: "grant_type=password&username=…". The value is
+      # bounded so `grant_type=password_reset` is not flagged.
+      - pattern-regex: |-
+              [?&'"]grant_type=password(?:[&'"\s]|$)
+      # Tuple/list pair form: ("grant_type", "password").
+      - pattern-regex: |-
+              ['"]grant_type['"]\s*,\s*['"]password['"]
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - requests
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html

package/rules/py/oauth/static-state.yml

@@ -0,0 +1,45 @@
+rules:
+  - id: auth.py.oauth.static-state
+    languages:
+      - python
+    severity: WARNING
+    message: |
+      OAuth authorization request sends a hardcoded, constant `state`
+      value. A static `state` provides ZERO CSRF protection — the whole
+      point is an unguessable, per-request value that you store and then
+      compare on the callback. A literal that ships in your source is known
+      to everyone and identical on every request, so an attacker can forge
+      a matching callback.
+
+      Generate `state` fresh per request from a CSPRNG
+      (`secrets.token_urlsafe(32)`), persist it in the session, and verify
+      it when the provider redirects back.
+    pattern-either:
+      # Authorize parameter dict carrying a `response_type` (so we know it is an
+      # authorize request, not some unrelated `state` field) AND a string-LITERAL
+      # `state`. A per-request value is a variable or a function call, which is
+      # not a quoted literal and so does not match.
+      - patterns:
+          - pattern: '{..., "response_type": ..., ...}'
+          - pattern-either:
+              - pattern: '{..., "state": "$S", ...}'
+      # Inline authorize URL string literal carrying both response_type and a
+      # constant state value. A dynamic state would be an f-string with `{state}`,
+      # whose `{` is excluded from the value character class below.
+      - patterns:
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*response_type=[^'"]*['"]
+          - pattern-regex: |-
+              ['"]https?://[^'"\s]+\?[^'"]*state=[A-Za-z0-9._~%-]+[^'"]*['"]
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/py/oauth/token-request-verify-disabled.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.py.oauth.token-request-verify-disabled
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      An OAuth client fetches or refreshes a token with TLS certificate
+      verification disabled (`verify=False`). The token request carries the
+      `client_secret`, the authorization `code`, and the issued access/refresh
+      tokens; with verification off, an attacker who can intercept the
+      connection presents any certificate and reads or tampers with them — a
+      classic man-in-the-middle on the most sensitive call in the flow
+      (CWE-295).
+
+      Never pass `verify=False` to `fetch_token` / `refresh_token` /
+      `fetch_access_token` (Authlib, requests-oauthlib). Leave verification on
+      (the default) so the system CA bundle is used, or point `verify` at a CA
+      bundle path for a private CA.
+    # Scoped to OAuth client token methods (Authlib OAuth1/2 sessions,
+    # requests-oauthlib) and the literal `verify=False`. `verify=True` and
+    # `verify="/path/ca.pem"` are not flagged. This is distinct from
+    # auth.py.flow.requests-verify-disabled, which covers the `requests` HTTP
+    # verbs (`get`/`post`/…); here the sink is the OAuth token-exchange call.
+    pattern-either:
+      - pattern: $C.fetch_token(..., verify=False, ...)
+      - pattern: $C.refresh_token(..., verify=False, ...)
+      - pattern: $C.fetch_access_token(..., verify=False, ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-OAUTH-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-token-request-verify-disabled
+      category: security
+      cwe: CWE-295
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - authlib
+        - requests-oauthlib
+      references:
+        - https://docs.authlib.org/en/latest/client/oauth2.html
+        - https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification
+        - https://cwe.mitre.org/data/definitions/295.html

package/rules/rust/oauth/insecure-token-endpoint.yml

@@ -0,0 +1,39 @@
+rules:
+  - id: auth.rust.oauth.insecure-token-endpoint
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      An OAuth/OIDC endpoint is being contacted over cleartext `http://`.
+      Authorization codes, `client_secret`, access/refresh tokens, and the
+      `code_verifier` then travel unencrypted — a network attacker can read
+      or rewrite them and take over the flow.
+
+      RFC 6749 §3.1 / §10.9 require TLS for the authorization and token
+      endpoints. Use `https://` for every authorize, token, and userinfo URL
+      (including the `oauth2` crate's `AuthUrl` / `TokenUrl`).
+      `http://localhost` is fine for local development and is not flagged.
+    # A string literal that targets an OAuth/OIDC endpoint over http://.
+    # Required OAuth markers keep this precise: a generic http URL is NOT
+    # flagged, only one carrying an authorize/token request or an /oauth path.
+    # `https://` cannot match, and the localhost / loopback dev hosts are
+    # subtracted below.
+    patterns:
+      - pattern-regex: |-
+          "http://[^"\s]+(?:response_type=|client_id=|client_secret=|grant_type=|code_challenge=|/oauth2?/|/connect/token|/o/oauth2|/authorize|/oauth/token)[^"]*"
+      - pattern-not-regex: |-
+          http://(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-OAUTH-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-insecure-token-endpoint
+      category: security
+      cwe: CWE-319
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+        - oidc
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.9
+        - https://cwe.mitre.org/data/definitions/319.html

package/rules/rust/oauth/ropc-grant.yml

@@ -0,0 +1,57 @@
+rules:
+  - id: auth.rust.oauth.ropc-grant
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      OAuth token request uses the Resource Owner Password Credentials
+      grant (`grant_type=password`). The app collects the user's password
+      and replays it to the authorization server — exactly what OAuth was
+      designed to avoid. It cannot support federation, MFA, or step-up
+      auth, and any compromise of your service exposes raw user passwords.
+
+      The OAuth 2.0 Security BCP (RFC 9700 §2.4) forbids ROPC and OAuth 2.1
+      removes it entirely. Use the authorization-code flow with PKCE
+      (`grant_type=authorization_code`) for user login, or
+      `client_credentials` for machine-to-machine. With the `oauth2` crate,
+      use `authorize_url` / `exchange_code` instead of `exchange_password`.
+    pattern-either:
+      # oauth2 crate ROPC helper — its only purpose is the password grant.
+      - pattern: $C.exchange_password(...)
+      # reqwest / hand-built form pair: ("grant_type", "password"). The value
+      # is bounded so `password_reset` and friends are not matched.
+      - pattern-regex: |-
+              "grant_type"\s*,\s*"password"
+      # URL-encoded request body string: "grant_type=password&username=…".
+      - pattern-regex: |-
+              [?&"]grant_type=password(?:[&"\s\\]|$)
+    # We flag an application sending ROPC, not the example/test code or vendored
+    # client libraries that legitimately exercise the grant. Excluding these
+    # trees keeps the signal on first-party application code. (`tests.rs` is the
+    # Rust convention for a sibling test module file, e.g. oauth2-rs'
+    # `src/token/tests.rs`.)
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/tests.rs"
+        - "**/*_test.*"
+        - "**/*.test.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/mock*/**"
+        - "**/vendor/**"
+        - "**/node_modules/**"
+        - "**/target/**"
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-OAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-ropc-grant
+      category: security
+      cwe: CWE-522
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc9700#section-2.4
+        - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-2.4
+        - https://cwe.mitre.org/data/definitions/522.html