oauthlint-rules 0.2.6 → 0.3.1

package/rules/rust/oauth/static-state.yml

@@ -0,0 +1,58 @@
+rules:
+  - id: auth.rust.oauth.static-state
+    languages:
+      - rust
+    severity: WARNING
+    message: |
+      OAuth authorization request is built with a hardcoded, constant `state`
+      value (`CsrfToken::new("literal")`). A static `state` provides ZERO CSRF
+      protection — the whole point is an unguessable, per-request value that
+      you store and then compare on the callback. A literal that ships in your
+      source is known to everyone and identical on every request, so an
+      attacker can forge a matching callback.
+
+      Use `CsrfToken::new_random` (the `oauth2` crate's CSPRNG-backed
+      generator), pass it to `authorize_url`, persist it in the session, and
+      verify it when the provider redirects back.
+    # `CsrfToken::new` with a STRING LITERAL is a constant state baked into the
+    # source. The four conversion forms below match only when the literal is the
+    # direct argument, so `CsrfToken::new(generate())` or a variable is never
+    # flagged. `CsrfToken::new_random()` is a different method and is not
+    # matched.
+    patterns:
+      - pattern-either:
+          - pattern: CsrfToken::new("...".to_string())
+          - pattern: CsrfToken::new("...".to_owned())
+          - pattern: CsrfToken::new("...".into())
+          - pattern: CsrfToken::new(String::from("..."))
+      # Unit tests routinely pass a fixed `state` to assert on the URL — that is
+      # the test asserting determinism, not an app shipping a constant CSRF
+      # token. The `#[cfg(test)] mod tests { ... }` block is the canonical Rust
+      # idiom (e.g. oauth2-rs' own crate tests), so suppress matches inside it.
+      - pattern-not-inside: mod tests {...}
+    # Belt-and-suspenders: never fire on test/example/vendored/generated trees.
+    # `tests.rs` is Rust's sibling test-module file convention.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/tests.rs"
+        - "**/*_test.*"
+        - "**/*.test.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/mock*/**"
+        - "**/vendor/**"
+        - "**/node_modules/**"
+        - "**/target/**"
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-OAUTH-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-static-state
+      category: security
+      cwe: CWE-330
+      owasp: API1:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - oauth2
+      references:
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
+        - https://cwe.mitre.org/data/definitions/330.html