oauthlint-rules 0.3.0 → 0.4.0

package/rules/flow/ssrf.yml

@@ -4,6 +4,25 @@ rules:
       - javascript
       - typescript
     severity: ERROR
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. Globs intentionally omit `**/tests/**` / `**/fixtures/**`
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/demo/**"
+        - "**/docs/**"
+        - "**/__mocks__/**"
+        - "**/mocks/**"
+        - "**/vendored/**"
+        - "**/node_modules/**"
+        - "**/*.stories.*"
     message: |
       Untrusted request input flows into the URL of an outbound HTTP request.
       Because the destination is attacker-controlled, this is a Server-Side
@@ -23,34 +42,55 @@ rules:
     # (isAllowedUrl, allowlist.includes, Set.has) clears the taint, so a
     # genuinely vetted outbound request does not fire.
     mode: taint
+    # `$REQ` is constrained to conventional request-object names so that
+    # unrelated receivers (`db.query`, `config.headers`, `someObj.body`) are not
+    # treated as untrusted request input.
     pattern-sources:
-      - pattern: $REQ.query
-      - pattern: $REQ.params
-      - pattern: $REQ.body
-      - pattern: $REQ.cookies
-      - pattern: $REQ.headers
-      - pattern: $REQ.query.$X
-      - pattern: $REQ.params.$X
-      - pattern: $REQ.body.$X
-      - pattern: $REQ.cookies.$X
-      - pattern: $REQ.headers.$X
-      - pattern: $REQ.query[$K]
-      - pattern: $REQ.params[$K]
-      - pattern: $REQ.body[$K]
-      - pattern: $REQ.cookies[$K]
-      - pattern: $REQ.headers[$K]
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.query
+              - pattern: $REQ.params
+              - pattern: $REQ.body
+              - pattern: $REQ.cookies
+              - pattern: $REQ.headers
+              - pattern: $REQ.query.$X
+              - pattern: $REQ.params.$X
+              - pattern: $REQ.body.$X
+              - pattern: $REQ.cookies.$X
+              - pattern: $REQ.headers.$X
+              - pattern: $REQ.query[$K]
+              - pattern: $REQ.params[$K]
+              - pattern: $REQ.body[$K]
+              - pattern: $REQ.cookies[$K]
+              - pattern: $REQ.headers[$K]
+          - metavariable-regex:
+              metavariable: $REQ
+              regex: ^(req|request|ctx|context|c|event|r)$
     pattern-sanitizers:
       # Routing the value through a host allow-list / validation helper clears
       # the taint: only the vetted destination (not the raw request input)
-      # reaches the request. Matched by a conventional validation-helper call,
-      # or by an allow-list membership test (`Set.has` / `Array.includes`) that
-      # the value is passed through.
+      # reaches the request.
       - pattern: isAllowedUrl(...)
       - pattern: validateUrl(...)
       - pattern: assertAllowedHost(...)
-      - pattern: $ALLOW.includes(...)
-      - pattern: $ALLOW.has(...)
-      - pattern: $ALLOW.indexOf(...)
+      # An inline allow-list membership guard vets the value: a value used inside
+      # `if (allow.has(x)) { ... }` / `if (allow.includes(x)) { ... }` /
+      # `if (allow.indexOf(x) ...) { ... }` is treated as validated. The
+      # boolean-returning membership call itself does NOT sanitize its argument
+      # (that would only clear the boolean, not the value), so we clear taint by
+      # the if-guard, mirroring the Python rule's `if is_allowed_url(v): ...`.
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ALLOW.has($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ALLOW.includes($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ALLOW.indexOf($X) ...>) { ... }
     pattern-sinks:
       - patterns:
           - pattern-either:

package/rules/flow/timing-unsafe-compare.yml

@@ -4,6 +4,25 @@ rules:
       - javascript
       - typescript
     severity: WARNING
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. Globs intentionally omit `**/tests/**` / `**/fixtures/**`
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/demo/**"
+        - "**/docs/**"
+        - "**/__mocks__/**"
+        - "**/mocks/**"
+        - "**/vendored/**"
+        - "**/node_modules/**"
+        - "**/*.stories.*"
     message: |
       A secret-shaped value (`password`, `token`, `secret`, `apiKey`,
       `csrf`, `hmac`) is being compared with `===` / `!==` /

package/rules/go/cookie/insecure.yml

@@ -35,7 +35,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/go-cookie-insecure
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - net/http

package/rules/go/cors/allow-all.yml

@@ -32,7 +32,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/go-cors-allow-all
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - gin

package/rules/go/flow/open-redirect.yml

@@ -18,9 +18,11 @@ rules:
       redirecting. See CWE-601.
     # Taint mode so indirection (dest := r.FormValue("url"); http.Redirect(w,
     # r, dest, ...)) is caught, not just the inline form. The taint is cleared
-    # by an allow-list / validation helper that vets the destination, or by a
-    # url.Parse(...)-then-checked flow where the parsed value is inspected
-    # before use.
+    # by an allow-list / validation helper that vets the destination, or inside
+    # an `if`-guard that checks the parsed host against an allow-list. A bare
+    # `url.Parse(...)` is NOT a sanitizer: the parsed struct's Host/Path/Scheme
+    # are still attacker-controlled, so parse-then-reflect without a host check
+    # is a real open redirect and must still fire.
     mode: taint
     pattern-sources:
       # $R is the *http.Request. Cover the common net/http input shapes.
@@ -35,9 +37,17 @@ rules:
       - pattern: validateRedirect(...)
       - pattern: isAllowedRedirect(...)
       - pattern: $ALLOW.MatchString(...)
-      # url.Parse-then-checked: a parsed URL that has been inspected is treated
-      # as cleared (the result is rebuilt/validated rather than reflected raw).
-      - pattern: url.Parse(...)
+      # parse-then-host-checked: a value used inside an `if`-guard that looks the
+      # parsed host up in an allow-list map is treated as vetted, mirroring the
+      # Python rule's `if is_safe_url(...):` guard. A bare `url.Parse(...)` is
+      # deliberately NOT listed — it returns an attacker-controlled struct and
+      # does not validate anything, so parse-then-reflect still fires.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if $ALLOW[$U.Host] {
+                ...
+              }
     pattern-sinks:
       - patterns:
           - pattern-either:

package/rules/go/flow/ssrf.yml

@@ -20,9 +20,11 @@ rules:
       link-local address ranges before dialing. See CWE-918.
     # Taint mode so indirection (target := r.FormValue("endpoint");
     # http.Get(target)) is caught, not just the inline form. The taint is
-    # cleared by an allow-list / host-validation helper, or by a
-    # url.Parse(...)-then-checked flow where the parsed host is vetted before
-    # the request is made.
+    # cleared by an allow-list / host-validation helper, or inside an
+    # `if`-guard that checks the parsed host against an allow-list. A bare
+    # `url.Parse(...)` is NOT a sanitizer: the parsed struct's Host/Path/Scheme
+    # are still attacker-controlled, so parse-then-use without a host check is a
+    # real SSRF and must still fire.
     mode: taint
     pattern-sources:
       # $R is the *http.Request. Cover the common net/http input shapes.
@@ -37,10 +39,17 @@ rules:
       - pattern: validateURL(...)
       - pattern: isAllowedHost(...)
       - pattern: $ALLOW.MatchString(...)
-      # url.Parse-then-checked: a parsed URL whose host has been inspected is
-      # treated as cleared (the request is built from a vetted destination
-      # rather than the raw untrusted string).
-      - pattern: url.Parse(...)
+      # parse-then-host-checked: a value used inside an `if`-guard that looks the
+      # parsed host up in an allow-list map is treated as vetted, mirroring the
+      # Python rule's `if is_allowed_url(...):` guard. A bare `url.Parse(...)` is
+      # deliberately NOT listed — it returns an attacker-controlled struct and
+      # does not validate anything, so parse-then-use still fires.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if $ALLOW[$U.Host] {
+                ...
+              }
     pattern-sinks:
       # Focus the URL argument so the finding lands on the tainted destination,
       # not the whole call. The plain call form is used (no aliasing) because

package/rules/go/oauth/ropc-grant.yml

@@ -34,6 +34,21 @@ rules:
       # value so only the password grant matches.
       - pattern-regex: |-
               [?&"`]grant_type=password(?:[&"`\s\\]|$)
+    # We flag an application sending ROPC, not the example/test code or vendored
+    # client libraries that legitimately implement the grant. Excluding these
+    # trees keeps the signal on first-party application code; a vendored copy of
+    # `golang.org/x/oauth2`, for instance, must not trip this rule.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/*_test.go"
+        - "**/*_test.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/mock*/**"
+        - "**/testdata/**"
+        - "**/vendor/**"
+        - "**/node_modules/**"
     metadata:
       oauthlint-rule-id: AUTH-GO-OAUTH-001
       oauthlint-doc-url: https://oauthlint.dev/rules/go-oauth-ropc-grant

package/rules/java/cookie/insecure.yml

@@ -22,7 +22,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-cookie-insecure
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - servlet

package/rules/java/cors/allow-all.yml

@@ -38,7 +38,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-cors-allow-all
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - spring-web

package/rules/java/cors/credentialed-wildcard.yml

@@ -34,7 +34,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-cors-credentialed-wildcard
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - spring-web

package/rules/java/flow/ssrf.yml

@@ -0,0 +1,113 @@
+rules:
+  - id: auth.java.flow.ssrf
+    languages:
+      - java
+    severity: ERROR
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. Globs intentionally omit `**/test/**`-style fixture paths
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/src/test/**"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/demo/**"
+        - "**/docs/**"
+    message: |
+      Untrusted request input flows into the URL of an outbound HTTP request.
+      Because the destination is attacker-controlled, this is a Server-Side
+      Request Forgery (CWE-918): an attacker can point the request at internal
+      services behind your firewall, or at the cloud metadata endpoint
+      (http://169.254.169.254/...) to steal IAM/instance credentials and pivot
+      deeper into your infrastructure.
+
+      Never build a request URL straight from a Spring `@RequestParam` /
+      `@RequestBody` value or a raw `HttpServletRequest.getParameter(...)` /
+      `getHeader(...)` value. Validate the destination against an explicit
+      allow-list of hosts (resolve the URL and check its host against the
+      allow-list, rejecting private/loopback ranges) before issuing the request
+      with `RestTemplate`, `WebClient`, OkHttp, or Apache HttpClient.
+    # Taint mode so indirection is caught — `String u = req.getParameter("url");
+    # restTemplate.getForObject(u, ...)` flags, not just the inline form.
+    # Passing the value through a host allow-list / validation guard
+    # (isAllowedUrl, validateUrl, assertAllowedHost, or an allow-list
+    # `contains(...)` if-guard) clears the taint, so a genuinely vetted
+    # outbound request does not fire.
+    mode: taint
+    pattern-sources:
+      # Spring MVC handler parameters annotated with @RequestParam / @RequestBody
+      # carry attacker-controlled request data. Focus the parameter so the taint
+      # tracks the value, not the whole method.
+      - patterns:
+          - pattern-either:
+              - pattern: "$RET $M(..., @RequestParam $T $P, ...) {...}"
+              - pattern: "$RET $M(..., @RequestParam(...) $T $P, ...) {...}"
+              - pattern: "$RET $M(..., @RequestBody $T $P, ...) {...}"
+          - focus-metavariable: $P
+      # Servlet API request accessors. Constrained to an HttpServletRequest
+      # receiver so unrelated `.getParameter(...)` / `.getHeader(...)` calls on
+      # other objects are not treated as untrusted input.
+      - pattern: (HttpServletRequest $REQ).getParameter(...)
+      - pattern: (HttpServletRequest $REQ).getParameterValues(...)
+      - pattern: (HttpServletRequest $REQ).getHeader(...)
+    pattern-sanitizers:
+      # Routing the value through a host allow-list / validation helper clears
+      # the taint: only the vetted destination (not the raw request input)
+      # reaches the request.
+      - pattern: isAllowedUrl(...)
+      - pattern: isAllowedHost(...)
+      - pattern: validateUrl(...)
+      - pattern: assertAllowedHost(...)
+      # An inline allow-list membership guard vets the value: a value used inside
+      # `if (allow.contains(...)) { ... }` is treated as validated, mirroring the
+      # Python rule's `if is_allowed_url(v): ...`. The boolean-returning
+      # membership call itself does NOT sanitize (that clears only the boolean),
+      # so taint is cleared by the if-guard.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if (<... $ALLOW.contains(<... $V ...>) ...>) { ... }
+    pattern-sinks:
+      # Focus the URL argument so the finding lands on the tainted destination,
+      # not the whole call.
+      - patterns:
+          - pattern-either:
+              # Spring RestTemplate.
+              - pattern: $RT.getForObject($URL, ...)
+              - pattern: $RT.getForEntity($URL, ...)
+              - pattern: $RT.postForObject($URL, ...)
+              - pattern: $RT.postForEntity($URL, ...)
+              - pattern: $RT.exchange($URL, ...)
+              - pattern: $RT.execute($URL, ...)
+              # Spring WebClient fluent URI.
+              - pattern: $WC.uri($URL)
+              - pattern: $WC.uri($URL, ...)
+              # OkHttp Request.Builder.
+              - pattern: $B.url($URL)
+              # Apache HttpClient request objects.
+              - pattern: new HttpGet($URL)
+              - pattern: new HttpPost($URL)
+              - pattern: new HttpPut($URL)
+              - pattern: new HttpDelete($URL)
+              - pattern: new HttpHead($URL)
+              # JDK URL/URI opened directly.
+              - pattern: new URL($URL)
+              - pattern: new URI($URL)
+          - focus-metavariable: $URL
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-FLOW-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-flow-ssrf
+      category: security
+      cwe: CWE-918
+      owasp: API7:2023
+      llm-prevalence: HIGH
+      technology:
+        - spring
+        - resttemplate
+        - webclient
+        - okhttp
+        - apache-httpclient
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/918.html

package/rules/java/session/fixation-disabled.yml

@@ -25,7 +25,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-session-fixation-disabled
       category: security
       cwe: CWE-384
-      owasp: A07:2021
+      owasp: API2:2023
       llm-prevalence: MEDIUM
       technology:
         - spring-security

package/rules/java/tls/trust-all-certs.yml

@@ -21,13 +21,24 @@ rules:
     # HttpClient's NoopHostnameVerifier. A HostnameVerifier with real
     # (non-trivial) logic and the default verifier are not matched.
     pattern-either:
-      # Lambda that always returns true: (hostname, session) -> true
-      - pattern: ($HOST, $SESSION) -> true
-      # Anonymous HostnameVerifier whose verify(...) just returns true.
-      - pattern: |
-          new HostnameVerifier() {
-            public boolean verify(String $H, SSLSession $S) { return true; }
-          }
+      # Lambda that always returns true, scoped to a hostname-verifier context
+      # so a generic two-arg lambda (BiPredicate, comparator, etc.) returning
+      # true is not mistaken for a permissive verifier.
+      - patterns:
+          - pattern: ($HOST, $SESSION) -> true
+          - pattern-either:
+              - pattern-inside: $X.setHostnameVerifier(...)
+              - pattern-inside: $X.setDefaultHostnameVerifier(...)
+      # Anonymous HostnameVerifier whose verify(...) just returns true, scoped to
+      # where it is actually installed as the verifier.
+      - patterns:
+          - pattern: |
+              new HostnameVerifier() {
+                public boolean verify(String $H, SSLSession $S) { return true; }
+              }
+          - pattern-either:
+              - pattern-inside: $X.setHostnameVerifier(...)
+              - pattern-inside: $X.setDefaultHostnameVerifier(...)
       # Apache HttpClient NoopHostnameVerifier (constructor or INSTANCE).
       - pattern: new org.apache.http.conn.ssl.NoopHostnameVerifier()
       - pattern: new NoopHostnameVerifier()

package/rules/oauth/no-state.yml

@@ -14,14 +14,15 @@ rules:
       substitute for `state` when handling browser sessions.
     pattern-either:
       # Inline authorize URL carrying both client_id and response_type but no
-      # state. The path is not hardcoded (Google uses /o/oauth2/v2/auth, etc.).
-      - patterns:
-          - pattern-regex: |-
-              ['"]https?://[^'"\s]+\?[^'"]*client_id=[^'"]*['"]
-          - pattern-regex: |-
-              response_type=
-          - pattern-not-regex: |-
-              state=
+      # state, evaluated per quoted URL literal (the lookaheads/lookbehind are
+      # bounded to the contents of one string by `[^'"]`). This avoids the
+      # file-level false negative where a `state=` elsewhere in the file (a
+      # comment, a different correct call) would suppress a genuinely
+      # state-less URL. The path is not hardcoded (Google uses
+      # /o/oauth2/v2/auth, etc.). Single/double quotes only — a dynamic
+      # template-literal URL (backticks) is excluded.
+      - pattern-regex: |-
+          ['"]https?://(?=[^'"]*[?&]client_id=)(?=[^'"]*[?&]response_type=)(?![^'"]*[?&]state=)[^'"]+['"]
       # Programmatic URLSearchParams build (AST object match — robust to key
       # order and length). Fires when client_id + response_type are present but
       # state is not (covers both `state: x` and the `state` shorthand).

package/rules/oauth/open-redirect-callback.yml

@@ -25,9 +25,24 @@ rules:
       - pattern: '$REQ.query[$K]'
       - pattern: '$REQ.body[$K]'
     pattern-sanitizers:
-      - pattern: '$SET.has(...)'
-      - pattern: '$ARR.includes(...)'
-      - pattern: '$ARR.indexOf(...)'
+      # An inline allow-list membership guard vets the value: a value used inside
+      # `if (set.has(x)) { ... }` / `if (arr.includes(x)) { ... }` /
+      # `if (arr.indexOf(x) ...) { ... }` is treated as validated. The
+      # boolean-returning membership call itself does NOT sanitize its argument
+      # (that would only clear the boolean, not the value), so we clear taint by
+      # the if-guard, mirroring the Python rule's `if is_safe_url(v): ...`.
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $SET.has($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ARR.includes($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ARR.indexOf($X) ...>) { ... }
     pattern-sinks:
       - patterns:
           - pattern-either:

package/rules/oauth/ropc-grant.yml

@@ -16,10 +16,15 @@ rules:
       (`grant_type=authorization_code`) for user login, or
       `client_credentials` for machine-to-machine.
     pattern-either:
-      # Object literal / assignment: { grant_type: 'password' } or
-      # grant_type = 'password'. The `=` alt also covers `grant_type = "password"`.
+      # Object literal entry: `{ grant_type: 'password' }` (bare or quoted key).
+      # The colon anchors it to a property, not a bare variable assignment.
       - pattern-regex: |-
-              grant_type\s*[:=]\s*['"]password['"]
+              grant_type\s*:\s*['"]password['"]
+      # Property write that builds a request body: `body.grant_type = 'password'`.
+      # The leading `.` requires a member assignment, so a library's own bare
+      # local `grant_type = 'password'` (an internal constant) is NOT flagged.
+      - pattern-regex: |-
+              \.grant_type\s*=\s*['"]password['"]
       # URL-encoded request body: "grant_type=password&username=…" (single,
       # double, or template-literal string). The value is bounded so
       # `grant_type=password_reset` and friends are not flagged.

package/rules/oauth/static-state.yml

@@ -28,13 +28,14 @@ rules:
               - pattern: 'new URLSearchParams({..., state: "$S", ...})'
               - pattern: "new URLSearchParams({..., state: '$S', ...})"
       # Inline authorize URL string literal carrying both response_type and a
-      # constant state value. A dynamic state would be a template literal
-      # (backticks) with `${...}`, which this single/double-quoted form excludes.
-      - patterns:
-          - pattern-regex: |-
-              ['"]https?://[^'"\s]+\?[^'"]*response_type=[^'"]*['"]
-          - pattern-regex: |-
-              ['"]https?://[^'"\s]+\?[^'"]*state=[A-Za-z0-9._~%-]+[^'"]*['"]
+      # constant state value WITHIN THE SAME quoted literal. Using a single
+      # regex (lookaheads bounded by `[^'"]`) prevents the file-level false
+      # positive where `response_type=` in one string and a constant `state=`
+      # in a different string would otherwise combine into a finding. A dynamic
+      # state would be a template literal (backticks) with `${...}`, which this
+      # single/double-quoted form excludes.
+      - pattern-regex: |-
+          ['"]https?://(?=[^'"]*[?&]response_type=)(?=[^'"]*[?&]state=[A-Za-z0-9._~%-]+)[^'"]+['"]
     metadata:
       oauthlint-rule-id: AUTH-OAUTH-016
       oauthlint-doc-url: https://oauthlint.dev/rules/oauth-static-state

package/rules/py/cookie/insecure-flags.yml

@@ -30,7 +30,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/py-cookie-insecure-flags
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - flask

package/rules/py/cors/allow-all.yml

@@ -46,7 +46,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/py-cors-allow-all
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - flask-cors

package/rules/py/flow/requests-verify-disabled.yml

@@ -41,7 +41,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-requests-verify-disabled
       category: security
       cwe: CWE-295
-      owasp: API8:2023
+      owasp: A02:2021
       llm-prevalence: HIGH
       technology:
         - requests

package/rules/py/oauth/ropc-grant.yml

@@ -21,12 +21,20 @@ rules:
     # (dict / kwarg form) or bounded token (URL-encoded form), so
     # `grant_type=password_reset` and `grant_type=client_credentials` never
     # fire, and a dynamic `grant_type=grant` variable is not a literal and is
-    # not flagged.
+    # not flagged. Each form anchors `grant_type` to a request-parameter
+    # position (dict key, call keyword, query string, or pair) so a library's
+    # own bare local assignment — `grant_type = "password"`, as in Authlib's
+    # `_guess_grant_type` — is NOT treated as an application sending the grant.
     pattern-either:
-      # Dict entry `"grant_type": "password"` or keyword `grant_type="password"`.
-      # The optional quote after the key covers the dict form's closing `"`.
+      # Dict / mapping entry: `{"grant_type": "password"}`. The key is a quoted
+      # literal followed by a colon, which a bare variable assignment is not.
       - pattern-regex: |-
-              grant_type['"]?\s*[:=]\s*['"]password['"]
+              ['"]grant_type['"]\s*:\s*['"]password['"]
+      # Call keyword argument: `fetch_token(..., grant_type="password")`. The
+      # leading `(` or `,` anchors it to an argument list, so a top-level
+      # statement `grant_type = "password"` (library internal) does not match.
+      - pattern-regex: |-
+              [(,]\s*grant_type\s*=\s*['"]password['"]
       # URL-encoded request body: "grant_type=password&username=…". The value is
       # bounded so `grant_type=password_reset` is not flagged.
       - pattern-regex: |-

package/rules/rust/cookie/insecure.yml

@@ -26,7 +26,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-cookie-insecure
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - cookie

package/rules/rust/cors/permissive.yml

@@ -27,7 +27,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-cors-permissive
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - actix-web