oauthlint-rules 0.3.0 → 0.3.1

package/dist/schema.d.ts

@@ -81,6 +81,16 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     patterns: z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
     fix: z.ZodOptional<z.ZodString>;
+    paths: z.ZodOptional<z.ZodObject<{
+        include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }>>;
     mode: z.ZodOptional<z.ZodEnum<["search", "taint"]>>;
     'pattern-sources': z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
     'pattern-sinks': z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
@@ -109,6 +119,10 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex'?: string[] | undefined;
     patterns?: unknown[] | undefined;
     fix?: string | undefined;
+    paths?: {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    } | undefined;
     mode?: "search" | "taint" | undefined;
     'pattern-sources'?: unknown[] | undefined;
     'pattern-sinks'?: unknown[] | undefined;
@@ -137,6 +151,10 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex'?: string[] | undefined;
     patterns?: unknown[] | undefined;
     fix?: string | undefined;
+    paths?: {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    } | undefined;
     mode?: "search" | "taint" | undefined;
     'pattern-sources'?: unknown[] | undefined;
     'pattern-sinks'?: unknown[] | undefined;
@@ -165,6 +183,10 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex'?: string[] | undefined;
     patterns?: unknown[] | undefined;
     fix?: string | undefined;
+    paths?: {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    } | undefined;
     mode?: "search" | "taint" | undefined;
     'pattern-sources'?: unknown[] | undefined;
     'pattern-sinks'?: unknown[] | undefined;
@@ -193,6 +215,10 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex'?: string[] | undefined;
     patterns?: unknown[] | undefined;
     fix?: string | undefined;
+    paths?: {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    } | undefined;
     mode?: "search" | "taint" | undefined;
     'pattern-sources'?: unknown[] | undefined;
     'pattern-sinks'?: unknown[] | undefined;
@@ -242,6 +268,16 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         patterns: z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
         fix: z.ZodOptional<z.ZodString>;
+        paths: z.ZodOptional<z.ZodObject<{
+            include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        }, {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        }>>;
         mode: z.ZodOptional<z.ZodEnum<["search", "taint"]>>;
         'pattern-sources': z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
         'pattern-sinks': z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
@@ -270,6 +306,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -298,6 +338,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -326,6 +370,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -354,6 +402,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -384,6 +436,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -414,6 +470,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,yCAAuC,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAUxE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CpB,CAAC;AAEJ,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,yCAAuC,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAqBxE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8CpB,CAAC;AAEJ,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/schema.js

@@ -32,6 +32,16 @@ export const OAuthLintMetadataSchema = z.object({
  * Semgrep accepts many shapes; we only validate the fields we rely on.
  */
 const PatternEntrySchema = z.lazy(() => z.union([z.string(), z.record(z.string(), z.unknown()), z.array(PatternEntrySchema)]));
+/**
+ * Semgrep `paths:` filter. Lets a rule scope itself to (or away from) files by
+ * glob. We use `exclude` to keep production-grant rules from firing on test,
+ * example, vendored, or generated code — locations that should never carry a
+ * real application's OAuth misuse. Passed straight through to Semgrep.
+ */
+const PathsSchema = z.object({
+    include: z.array(z.string()).optional(),
+    exclude: z.array(z.string()).optional(),
+});
 export const RuleSchema = z
     .object({
     // auth.<category>.<name> for the JS/TS pack; language packs prepend a
@@ -53,6 +63,8 @@ export const RuleSchema = z
     'pattern-either-regex': z.array(z.string()).optional(),
     patterns: z.array(PatternEntrySchema).optional(),
     fix: z.string().optional(),
+    // Scope a rule to/away from files by glob (passed through to Semgrep).
+    paths: PathsSchema.optional(),
     // Taint-mode rules (Semgrep dataflow).
     mode: z.enum(['search', 'taint']).optional(),
     'pattern-sources': z.array(PatternEntrySchema).optional(),

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,yEAAyE;IACzE,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;QACrE,OAAO,EACL,8FAA8F;KACjG,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/B,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,kBAAkB,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACtF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,sEAAsE;IACtE,iFAAiF;IACjF,qEAAqE;IACrE,0EAA0E;IAC1E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE;QAClF,OAAO,EACL,0FAA0F;KAC7F,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,wCAAwC,CAAC;IACrE,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uCAAuC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,SAAS;IAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,SAAS;IACpC,IAAI,CAAC,QAAQ,KAAK,SAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS;IACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,SAAS;IAC1C,qEAAqE;IACrE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACrC,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,EACxC;IACE,OAAO,EACL,6IAA6I;CAChJ,CACF,CAAC;AAIJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,yEAAyE;IACzE,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;QACrE,OAAO,EACL,8FAA8F;KACjG,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/B,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,kBAAkB,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACtF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,sEAAsE;IACtE,iFAAiF;IACjF,qEAAqE;IACrE,0EAA0E;IAC1E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE;QAClF,OAAO,EACL,0FAA0F;KAC7F,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,wCAAwC,CAAC;IACrE,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uEAAuE;IACvE,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,uCAAuC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,SAAS;IAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,SAAS;IACpC,IAAI,CAAC,QAAQ,KAAK,SAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS;IACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,SAAS;IAC1C,qEAAqE;IACrE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACrC,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,EACxC;IACE,OAAO,EACL,6IAA6I;CAChJ,CACF,CAAC;AAIJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/cookie/samesite-none-insecure.yml

@@ -4,6 +4,28 @@ rules:
       - javascript
       - typescript
     severity: WARNING
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. In particular this skips vendored third-party cookie
+    # serializers (e.g. packages/core/src/lib/vendored/cookie.ts) whose
+    # incremental `"; SameSite=None"` attribute fragment is not a complete
+    # insecure cookie. Globs intentionally omit `**/tests/**` / `**/fixtures/**`
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/apps/**"
+        - "**/docs/**"
+        - "**/__mocks__/**"
+        - "**/mocks/**"
+        - "**/vendored/**"
+        - "**/node_modules/**"
+        - "**/*.stories.*"
     message: |
       A cookie is being set with `SameSite=None` but WITHOUT `Secure`.
       `SameSite=None` *requires* `Secure`: modern browsers reject a

package/rules/flow/open-redirect.yml

@@ -61,6 +61,17 @@ rules:
               - pattern: "$RES.setHeader('Location', $SINK)"
               - pattern: '$RES.setHeader("Location", $SINK)'
               - pattern: "$RES.writeHead($S, {..., Location: $SINK, ...})"
+          # `$RES.redirect(...)` / `$RES.location(...)` also match a bare,
+          # receiver-less `redirect(...)` / `location(...)` call. Those are the
+          # framework navigation primitives exported by Next.js
+          # (`next/navigation`), SvelteKit and Remix — they send the user to a
+          # server-constructed application URL, not the Express `res.redirect`
+          # open-redirect sink this rule targets. Requiring an explicit receiver
+          # removes that over-match (the dominant FP class seen on next-auth)
+          # without affecting any `res.redirect` / `res.location` detection.
+          - pattern-not: redirect($SINK)
+          - pattern-not: redirect($CODE, $SINK)
+          - pattern-not: location($SINK)
           - focus-metavariable: $SINK
     metadata:
       oauthlint-rule-id: AUTH-FLOW-010

package/rules/flow/ssrf.yml

@@ -4,6 +4,25 @@ rules:
       - javascript
       - typescript
     severity: ERROR
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. Globs intentionally omit `**/tests/**` / `**/fixtures/**`
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/apps/**"
+        - "**/docs/**"
+        - "**/__mocks__/**"
+        - "**/mocks/**"
+        - "**/vendored/**"
+        - "**/node_modules/**"
+        - "**/*.stories.*"
     message: |
       Untrusted request input flows into the URL of an outbound HTTP request.
       Because the destination is attacker-controlled, this is a Server-Side

package/rules/flow/timing-unsafe-compare.yml

@@ -4,6 +4,25 @@ rules:
       - javascript
       - typescript
     severity: WARNING
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. Globs intentionally omit `**/tests/**` / `**/fixtures/**`
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/apps/**"
+        - "**/docs/**"
+        - "**/__mocks__/**"
+        - "**/mocks/**"
+        - "**/vendored/**"
+        - "**/node_modules/**"
+        - "**/*.stories.*"
     message: |
       A secret-shaped value (`password`, `token`, `secret`, `apiKey`,
       `csrf`, `hmac`) is being compared with `===` / `!==` /

package/rules/go/oauth/ropc-grant.yml

@@ -34,6 +34,21 @@ rules:
       # value so only the password grant matches.
       - pattern-regex: |-
               [?&"`]grant_type=password(?:[&"`\s\\]|$)
+    # We flag an application sending ROPC, not the example/test code or vendored
+    # client libraries that legitimately implement the grant. Excluding these
+    # trees keeps the signal on first-party application code; a vendored copy of
+    # `golang.org/x/oauth2`, for instance, must not trip this rule.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/*_test.go"
+        - "**/*_test.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/mock*/**"
+        - "**/testdata/**"
+        - "**/vendor/**"
+        - "**/node_modules/**"
     metadata:
       oauthlint-rule-id: AUTH-GO-OAUTH-001
       oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-ropc-grant

package/rules/oauth/ropc-grant.yml

@@ -16,10 +16,15 @@ rules:
       (`grant_type=authorization_code`) for user login, or
       `client_credentials` for machine-to-machine.
     pattern-either:
-      # Object literal / assignment: { grant_type: 'password' } or
-      # grant_type = 'password'. The `=` alt also covers `grant_type = "password"`.
+      # Object literal entry: `{ grant_type: 'password' }` (bare or quoted key).
+      # The colon anchors it to a property, not a bare variable assignment.
       - pattern-regex: |-
-              grant_type\s*[:=]\s*['"]password['"]
+              grant_type\s*:\s*['"]password['"]
+      # Property write that builds a request body: `body.grant_type = 'password'`.
+      # The leading `.` requires a member assignment, so a library's own bare
+      # local `grant_type = 'password'` (an internal constant) is NOT flagged.
+      - pattern-regex: |-
+              \.grant_type\s*=\s*['"]password['"]
       # URL-encoded request body: "grant_type=password&username=…" (single,
       # double, or template-literal string). The value is bounded so
       # `grant_type=password_reset` and friends are not flagged.

package/rules/py/oauth/ropc-grant.yml

@@ -21,12 +21,20 @@ rules:
     # (dict / kwarg form) or bounded token (URL-encoded form), so
     # `grant_type=password_reset` and `grant_type=client_credentials` never
     # fire, and a dynamic `grant_type=grant` variable is not a literal and is
-    # not flagged.
+    # not flagged. Each form anchors `grant_type` to a request-parameter
+    # position (dict key, call keyword, query string, or pair) so a library's
+    # own bare local assignment — `grant_type = "password"`, as in Authlib's
+    # `_guess_grant_type` — is NOT treated as an application sending the grant.
     pattern-either:
-      # Dict entry `"grant_type": "password"` or keyword `grant_type="password"`.
-      # The optional quote after the key covers the dict form's closing `"`.
+      # Dict / mapping entry: `{"grant_type": "password"}`. The key is a quoted
+      # literal followed by a colon, which a bare variable assignment is not.
       - pattern-regex: |-
-              grant_type['"]?\s*[:=]\s*['"]password['"]
+              ['"]grant_type['"]\s*:\s*['"]password['"]
+      # Call keyword argument: `fetch_token(..., grant_type="password")`. The
+      # leading `(` or `,` anchors it to an argument list, so a top-level
+      # statement `grant_type = "password"` (library internal) does not match.
+      - pattern-regex: |-
+              [(,]\s*grant_type\s*=\s*['"]password['"]
       # URL-encoded request body: "grant_type=password&username=…". The value is
       # bounded so `grant_type=password_reset` is not flagged.
       - pattern-regex: |-

package/rules/rust/oauth/ropc-grant.yml

@@ -25,6 +25,23 @@ rules:
       # URL-encoded request body string: "grant_type=password&username=…".
       - pattern-regex: |-
               [?&"]grant_type=password(?:[&"\s\\]|$)
+    # We flag an application sending ROPC, not the example/test code or vendored
+    # client libraries that legitimately exercise the grant. Excluding these
+    # trees keeps the signal on first-party application code. (`tests.rs` is the
+    # Rust convention for a sibling test module file, e.g. oauth2-rs'
+    # `src/token/tests.rs`.)
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/tests.rs"
+        - "**/*_test.*"
+        - "**/*.test.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/mock*/**"
+        - "**/vendor/**"
+        - "**/node_modules/**"
+        - "**/target/**"
     metadata:
       oauthlint-rule-id: AUTH-RUST-OAUTH-001
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-ropc-grant

package/rules/rust/oauth/static-state.yml

@@ -19,11 +19,31 @@ rules:
     # direct argument, so `CsrfToken::new(generate())` or a variable is never
     # flagged. `CsrfToken::new_random()` is a different method and is not
     # matched.
-    pattern-either:
-      - pattern: CsrfToken::new("...".to_string())
-      - pattern: CsrfToken::new("...".to_owned())
-      - pattern: CsrfToken::new("...".into())
-      - pattern: CsrfToken::new(String::from("..."))
+    patterns:
+      - pattern-either:
+          - pattern: CsrfToken::new("...".to_string())
+          - pattern: CsrfToken::new("...".to_owned())
+          - pattern: CsrfToken::new("...".into())
+          - pattern: CsrfToken::new(String::from("..."))
+      # Unit tests routinely pass a fixed `state` to assert on the URL — that is
+      # the test asserting determinism, not an app shipping a constant CSRF
+      # token. The `#[cfg(test)] mod tests { ... }` block is the canonical Rust
+      # idiom (e.g. oauth2-rs' own crate tests), so suppress matches inside it.
+      - pattern-not-inside: mod tests {...}
+    # Belt-and-suspenders: never fire on test/example/vendored/generated trees.
+    # `tests.rs` is Rust's sibling test-module file convention.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/tests.rs"
+        - "**/*_test.*"
+        - "**/*.test.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/mock*/**"
+        - "**/vendor/**"
+        - "**/node_modules/**"
+        - "**/target/**"
     metadata:
       oauthlint-rule-id: AUTH-RUST-OAUTH-003
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-static-state