oauthlint-rules 0.3.0 → 0.4.0

package/rules/rust/flow/ssrf.yml

@@ -0,0 +1,90 @@
+rules:
+  - id: auth.rust.flow.ssrf
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the URL of an outbound HTTP request.
+      Because the destination is attacker-controlled, this is a Server-Side
+      Request Forgery (CWE-918): an attacker can point the request at internal
+      services behind your firewall, or at the cloud metadata endpoint
+      (http://169.254.169.254/...) to steal IAM/instance credentials and pivot
+      deeper into your infrastructure.
+
+      Never pass a request-derived `String` (an axum/actix handler parameter, or
+      a value taken from request input) straight into `reqwest::get(...)` or a
+      `Client::get(...)` / `Client::post(...).send()`. Validate the destination
+      host against an explicit allow-list (parse the URL and check the resolved
+      host/scheme, rejecting private/loopback/link-local ranges) before issuing
+      the request.
+    # Taint mode so indirection (let u = params.url; reqwest::get(u)) is caught,
+    # not just the inline form. The source is narrowed to function PARAMETERS
+    # (the shape an axum/actix handler takes its request data in) so an
+    # arbitrary local `let url = "https://constant"` is not treated as untrusted
+    # — only data arriving as a handler/function parameter is. The taint is
+    # cleared by an allow-list / host-validation if-guard, mirroring the Python
+    # and Go SSRF rules.
+    mode: taint
+    pattern-sources:
+      # A function parameter carrying request data: a bare `String` (the typical
+      # axum `String` / extracted field), or an axum `Query`/`Path` extractor
+      # (both the type-position and the destructured forms). Focus the parameter
+      # so the taint tracks the value rather than the whole function.
+      - patterns:
+          - pattern-either:
+              - pattern: "fn $F(..., $P: String, ...) {...}"
+              - pattern: "fn $F(..., $P: Query<$T>, ...) {...}"
+              - pattern: "fn $F(..., $P: Path<$T>, ...) {...}"
+              - pattern: "fn $F(..., Query($P): Query<$T>, ...) {...}"
+              - pattern: "fn $F(..., Path($P): Path<$T>, ...) {...}"
+          - focus-metavariable: $P
+    pattern-sanitizers:
+      # A value used inside an allow-list / host-validation if-guard is treated
+      # as vetted, so the guarded request does not fire. A bare `Url::parse(...)`
+      # is deliberately NOT a sanitizer: the parsed URL is still
+      # attacker-controlled, so parse-then-use without a host check must fire.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if is_allowed_url(<... $V ...>) {
+                  ...
+              }
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if validate_host(<... $V ...>) {
+                  ...
+              }
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if $ALLOW.contains(<... $V ...>) {
+                  ...
+              }
+    pattern-sinks:
+      # Focus the URL argument so the finding lands on the tainted destination.
+      - patterns:
+          - pattern-either:
+              - pattern: reqwest::get($URL)
+              - pattern: reqwest::blocking::get($URL)
+              - pattern: $C.get($URL).send()
+              - pattern: $C.post($URL).send()
+              - pattern: $C.put($URL).send()
+              - pattern: $C.delete($URL).send()
+              - pattern: $C.head($URL).send()
+              - pattern: $C.request($M, $URL).send()
+          - focus-metavariable: $URL
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-FLOW-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-flow-ssrf
+      category: security
+      cwe: CWE-918
+      owasp: API7:2023
+      llm-prevalence: HIGH
+      technology:
+        - reqwest
+        - axum
+        - actix-web
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/918.html

package/rules/rust/oauth/ropc-grant.yml

@@ -25,6 +25,23 @@ rules:
       # URL-encoded request body string: "grant_type=password&username=…".
       - pattern-regex: |-
               [?&"]grant_type=password(?:[&"\s\\]|$)
+    # We flag an application sending ROPC, not the example/test code or vendored
+    # client libraries that legitimately exercise the grant. Excluding these
+    # trees keeps the signal on first-party application code. (`tests.rs` is the
+    # Rust convention for a sibling test module file, e.g. oauth2-rs'
+    # `src/token/tests.rs`.)
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/tests.rs"
+        - "**/*_test.*"
+        - "**/*.test.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/mock*/**"
+        - "**/vendor/**"
+        - "**/node_modules/**"
+        - "**/target/**"
     metadata:
       oauthlint-rule-id: AUTH-RUST-OAUTH-001
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-ropc-grant

package/rules/rust/oauth/static-state.yml

@@ -19,11 +19,31 @@ rules:
     # direct argument, so `CsrfToken::new(generate())` or a variable is never
     # flagged. `CsrfToken::new_random()` is a different method and is not
     # matched.
-    pattern-either:
-      - pattern: CsrfToken::new("...".to_string())
-      - pattern: CsrfToken::new("...".to_owned())
-      - pattern: CsrfToken::new("...".into())
-      - pattern: CsrfToken::new(String::from("..."))
+    patterns:
+      - pattern-either:
+          - pattern: CsrfToken::new("...".to_string())
+          - pattern: CsrfToken::new("...".to_owned())
+          - pattern: CsrfToken::new("...".into())
+          - pattern: CsrfToken::new(String::from("..."))
+      # Unit tests routinely pass a fixed `state` to assert on the URL — that is
+      # the test asserting determinism, not an app shipping a constant CSRF
+      # token. The `#[cfg(test)] mod tests { ... }` block is the canonical Rust
+      # idiom (e.g. oauth2-rs' own crate tests), so suppress matches inside it.
+      - pattern-not-inside: mod tests {...}
+    # Belt-and-suspenders: never fire on test/example/vendored/generated trees.
+    # `tests.rs` is Rust's sibling test-module file convention.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/tests.rs"
+        - "**/*_test.*"
+        - "**/*.test.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/mock*/**"
+        - "**/vendor/**"
+        - "**/node_modules/**"
+        - "**/target/**"
     metadata:
       oauthlint-rule-id: AUTH-RUST-OAUTH-003
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-oauth-static-state

package/rules/tls/reject-unauthorized.yml

@@ -31,7 +31,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/tls-reject-unauthorized
       category: security
       cwe: CWE-295
-      owasp: A05:2021
+      owasp: A02:2021
       llm-prevalence: HIGH
       technology:
         - node