npm - oauthlint-rules - Versions diffs - 0.3.1 → 0.4.0 - Mend

oauthlint-rules 0.3.1 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (34) hide show

package/dist/loader.d.ts +1 -1
package/dist/schema.d.ts +19 -19
package/dist/schema.d.ts.map +1 -1
package/dist/schema.js +1 -4
package/dist/schema.js.map +1 -1
package/package.json +1 -1
package/rules/cookie/no-samesite.yml +1 -1
package/rules/cookie/samesite-none-insecure.yml +1 -1
package/rules/cors/null-origin.yml +1 -1
package/rules/cors/reflect-origin.yml +1 -1
package/rules/flow/basic-auth-in-log.yml +99 -0
package/rules/flow/open-redirect.yml +42 -21
package/rules/flow/ssrf.yml +43 -22
package/rules/flow/timing-unsafe-compare.yml +1 -1
package/rules/go/cookie/insecure.yml +1 -1
package/rules/go/cors/allow-all.yml +1 -1
package/rules/go/flow/open-redirect.yml +16 -6
package/rules/go/flow/ssrf.yml +16 -7
package/rules/java/cookie/insecure.yml +1 -1
package/rules/java/cors/allow-all.yml +1 -1
package/rules/java/cors/credentialed-wildcard.yml +1 -1
package/rules/java/flow/ssrf.yml +113 -0
package/rules/java/session/fixation-disabled.yml +1 -1
package/rules/java/tls/trust-all-certs.yml +18 -7
package/rules/oauth/no-state.yml +9 -8
package/rules/oauth/open-redirect-callback.yml +18 -3
package/rules/oauth/static-state.yml +8 -7
package/rules/py/cookie/insecure-flags.yml +1 -1
package/rules/py/cors/allow-all.yml +1 -1
package/rules/py/flow/requests-verify-disabled.yml +1 -1
package/rules/rust/cookie/insecure.yml +1 -1
package/rules/rust/cors/permissive.yml +1 -1
package/rules/rust/flow/ssrf.yml +90 -0
package/rules/tls/reject-unauthorized.yml +1 -1

package/dist/loader.d.ts CHANGED Viewed

@@ -26,7 +26,7 @@ export declare function buildManifest(root?: string): Promise<{
     oauthlintId: string;
     docUrl: string;
     llmPrevalence: "HIGH" | "MEDIUM" | "LOW";
-    cwe: string | undefined;
+    cwe: string;
     owasp: string | undefined;
     description: string;
     sourceFile: string;

package/dist/schema.d.ts CHANGED Viewed

@@ -15,7 +15,7 @@ export declare const OAuthLintMetadataSchema: z.ZodObject<{
     'oauthlint-rule-id': z.ZodString;
     'oauthlint-doc-url': z.ZodString;
     category: z.ZodLiteral<"security">;
-    cwe: z.ZodOptional<z.ZodString>;
+    cwe: z.ZodString;
     owasp: z.ZodOptional<z.ZodString>;
     'llm-prevalence': z.ZodEnum<["HIGH", "MEDIUM", "LOW"]>;
     references: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -24,8 +24,8 @@ export declare const OAuthLintMetadataSchema: z.ZodObject<{
     'oauthlint-rule-id': string;
     'oauthlint-doc-url': string;
     category: "security";
+    cwe: string;
     'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-    cwe?: string | undefined;
     owasp?: string | undefined;
     references?: string[] | undefined;
     technology?: string[] | undefined;
@@ -33,8 +33,8 @@ export declare const OAuthLintMetadataSchema: z.ZodObject<{
     'oauthlint-rule-id': string;
     'oauthlint-doc-url': string;
     category: "security";
+    cwe: string;
     'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-    cwe?: string | undefined;
     owasp?: string | undefined;
     references?: string[] | undefined;
     technology?: string[] | undefined;
@@ -49,7 +49,7 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
         'oauthlint-rule-id': z.ZodString;
         'oauthlint-doc-url': z.ZodString;
         category: z.ZodLiteral<"security">;
-        cwe: z.ZodOptional<z.ZodString>;
+        cwe: z.ZodString;
         owasp: z.ZodOptional<z.ZodString>;
         'llm-prevalence': z.ZodEnum<["HIGH", "MEDIUM", "LOW"]>;
         references: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -58,8 +58,8 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
         'oauthlint-rule-id': string;
         'oauthlint-doc-url': string;
         category: "security";
+        cwe: string;
         'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-        cwe?: string | undefined;
         owasp?: string | undefined;
         references?: string[] | undefined;
         technology?: string[] | undefined;
@@ -67,8 +67,8 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
         'oauthlint-rule-id': string;
         'oauthlint-doc-url': string;
         category: "security";
+        cwe: string;
         'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-        cwe?: string | undefined;
         owasp?: string | undefined;
         references?: string[] | undefined;
         technology?: string[] | undefined;
@@ -105,8 +105,8 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
         'oauthlint-rule-id': string;
         'oauthlint-doc-url': string;
         category: "security";
+        cwe: string;
         'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-        cwe?: string | undefined;
         owasp?: string | undefined;
         references?: string[] | undefined;
         technology?: string[] | undefined;
@@ -137,8 +137,8 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
         'oauthlint-rule-id': string;
         'oauthlint-doc-url': string;
         category: "security";
+        cwe: string;
         'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-        cwe?: string | undefined;
         owasp?: string | undefined;
         references?: string[] | undefined;
         technology?: string[] | undefined;
@@ -169,8 +169,8 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
         'oauthlint-rule-id': string;
         'oauthlint-doc-url': string;
         category: "security";
+        cwe: string;
         'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-        cwe?: string | undefined;
         owasp?: string | undefined;
         references?: string[] | undefined;
         technology?: string[] | undefined;
@@ -201,8 +201,8 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
         'oauthlint-rule-id': string;
         'oauthlint-doc-url': string;
         category: "security";
+        cwe: string;
         'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-        cwe?: string | undefined;
         owasp?: string | undefined;
         references?: string[] | undefined;
         technology?: string[] | undefined;
@@ -236,7 +236,7 @@ export declare const RuleFileSchema: z.ZodObject<{
             'oauthlint-rule-id': z.ZodString;
             'oauthlint-doc-url': z.ZodString;
             category: z.ZodLiteral<"security">;
-            cwe: z.ZodOptional<z.ZodString>;
+            cwe: z.ZodString;
             owasp: z.ZodOptional<z.ZodString>;
             'llm-prevalence': z.ZodEnum<["HIGH", "MEDIUM", "LOW"]>;
             references: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -245,8 +245,8 @@ export declare const RuleFileSchema: z.ZodObject<{
             'oauthlint-rule-id': string;
             'oauthlint-doc-url': string;
             category: "security";
+            cwe: string;
             'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-            cwe?: string | undefined;
             owasp?: string | undefined;
             references?: string[] | undefined;
             technology?: string[] | undefined;
@@ -254,8 +254,8 @@ export declare const RuleFileSchema: z.ZodObject<{
             'oauthlint-rule-id': string;
             'oauthlint-doc-url': string;
             category: "security";
+            cwe: string;
             'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-            cwe?: string | undefined;
             owasp?: string | undefined;
             references?: string[] | undefined;
             technology?: string[] | undefined;
@@ -292,8 +292,8 @@ export declare const RuleFileSchema: z.ZodObject<{
             'oauthlint-rule-id': string;
             'oauthlint-doc-url': string;
             category: "security";
+            cwe: string;
             'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-            cwe?: string | undefined;
             owasp?: string | undefined;
             references?: string[] | undefined;
             technology?: string[] | undefined;
@@ -324,8 +324,8 @@ export declare const RuleFileSchema: z.ZodObject<{
             'oauthlint-rule-id': string;
             'oauthlint-doc-url': string;
             category: "security";
+            cwe: string;
             'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-            cwe?: string | undefined;
             owasp?: string | undefined;
             references?: string[] | undefined;
             technology?: string[] | undefined;
@@ -356,8 +356,8 @@ export declare const RuleFileSchema: z.ZodObject<{
             'oauthlint-rule-id': string;
             'oauthlint-doc-url': string;
             category: "security";
+            cwe: string;
             'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-            cwe?: string | undefined;
             owasp?: string | undefined;
             references?: string[] | undefined;
             technology?: string[] | undefined;
@@ -388,8 +388,8 @@ export declare const RuleFileSchema: z.ZodObject<{
             'oauthlint-rule-id': string;
             'oauthlint-doc-url': string;
             category: "security";
+            cwe: string;
             'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-            cwe?: string | undefined;
             owasp?: string | undefined;
             references?: string[] | undefined;
             technology?: string[] | undefined;
@@ -422,8 +422,8 @@ export declare const RuleFileSchema: z.ZodObject<{
             'oauthlint-rule-id': string;
             'oauthlint-doc-url': string;
             category: "security";
+            cwe: string;
             'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-            cwe?: string | undefined;
             owasp?: string | undefined;
             references?: string[] | undefined;
             technology?: string[] | undefined;
@@ -456,8 +456,8 @@ export declare const RuleFileSchema: z.ZodObject<{
             'oauthlint-rule-id': string;
             'oauthlint-doc-url': string;
             category: "security";
+            cwe: string;
             'llm-prevalence': "HIGH" | "MEDIUM" | "LOW";
-            cwe?: string | undefined;
             owasp?: string | undefined;
             references?: string[] | undefined;
             technology?: string[] | undefined;

package/dist/schema.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,yCAAuC,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;~~EAiBlC~~,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAqBxE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8CpB,CAAC;AAEJ,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
1	+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,yCAAuC,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAclC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAqBxE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8CpB,CAAC;AAEJ,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/schema.js CHANGED Viewed

@@ -18,10 +18,7 @@ export const OAuthLintMetadataSchema = z.object({
     }),
     'oauthlint-doc-url': z.string().url(),
     category: z.literal('security'),
-    cwe: z
-        .string()
-        .regex(/^CWE-\d+$/)
-        .optional(),
+    cwe: z.string().regex(/^CWE-\d+$/),
     owasp: z.string().optional(),
     'llm-prevalence': z.enum(['HIGH', 'MEDIUM', 'LOW']),
     references: z.array(z.string().url()).optional(),

package/dist/schema.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,yEAAyE;IACzE,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;QACrE,OAAO,EACL,8FAA8F;KACjG,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/B,GAAG,EAAE,CAAC~~;SACH~~,MAAM,EAAE~~;SACR~~,KAAK,CAAC,WAAW,CAAC;~~SAClB~~,~~QAAQ,EAAE;IACb,~~KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,kBAAkB,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACtF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,sEAAsE;IACtE,iFAAiF;IACjF,qEAAqE;IACrE,0EAA0E;IAC1E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE;QAClF,OAAO,EACL,0FAA0F;KAC7F,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,wCAAwC,CAAC;IACrE,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uEAAuE;IACvE,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,uCAAuC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,SAAS;IAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,SAAS;IACpC,IAAI,CAAC,QAAQ,KAAK,SAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS;IACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,SAAS;IAC1C,qEAAqE;IACrE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACrC,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,EACxC;IACE,OAAO,EACL,6IAA6I;CAChJ,CACF,CAAC;AAIJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC"}
1	+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,yEAAyE;IACzE,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;QACrE,OAAO,EACL,8FAA8F;KACjG,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,kBAAkB,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACtF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,sEAAsE;IACtE,iFAAiF;IACjF,qEAAqE;IACrE,0EAA0E;IAC1E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE;QAClF,OAAO,EACL,0FAA0F;KAC7F,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,wCAAwC,CAAC;IACrE,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uEAAuE;IACvE,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,uCAAuC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,SAAS;IAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,SAAS;IACpC,IAAI,CAAC,QAAQ,KAAK,SAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS;IACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,SAAS;IAC1C,qEAAqE;IACrE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACrC,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,EACxC;IACE,OAAO,EACL,6IAA6I;CAChJ,CACF,CAAC;AAIJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/cookie/no-samesite.yml CHANGED Viewed

@@ -51,7 +51,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-samesite
       category: security
       cwe: CWE-1275
-      owasp: API1:2023
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - express

package/rules/cookie/samesite-none-insecure.yml CHANGED Viewed

@@ -62,7 +62,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-samesite-none-insecure
       category: security
       cwe: CWE-1275
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - express

package/rules/cors/null-origin.yml CHANGED Viewed

@@ -43,7 +43,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/cors-null-origin
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - cors

package/rules/cors/reflect-origin.yml CHANGED Viewed

@@ -68,7 +68,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/cors-reflect-origin
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - cors

package/rules/flow/basic-auth-in-log.yml ADDED Viewed

@@ -0,0 +1,99 @@
+rules:
+  - id: auth.flow.basic-auth-in-log
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      HTTP Basic credentials flow into a logging call (`console.*` or
+      `logger.*`). The `basic-auth` package returns the decoded `{ name, pass }`
+      for the request, and the `Proxy-Authorization` header carries
+      base64-encoded `user:password` just like `Authorization` does. Logs are
+      written to files, shipped to aggregators (Datadog, Splunk, CloudWatch) and
+      read by people and systems that should never see live credentials — the
+      base64 is trivially reversible, so a logged Basic header or a logged
+      `creds.pass` is a plaintext password leak (CWE-532).
+      Never log the raw credential. Redact or mask it before logging, log a
+      non-sensitive identifier instead (the username alone, a user id), or drop
+      the field entirely.
+    # Taint mode so indirection is caught — `const creds = auth(req);
+    # logger.info(creds.pass)` flags, not just an inline log.
+    #
+    # SCOPE / non-duplication: auth.flow.oauth-credential-in-log already covers
+    # the raw `Authorization` header (`req.headers.authorization`,
+    # `req.get('authorization')`, `req.header('authorization')`) flowing into a
+    # log, so this rule deliberately does NOT re-list those sources. It adds the
+    # genuinely-uncovered Basic-auth sources: the `basic-auth` package's parse
+    # result (`auth(req)` / `basicAuth(req)`, incl. `.name` / `.pass`) and the
+    # `Proxy-Authorization` header. Routing the value through a redaction /
+    # masking helper or a truncating slice clears the taint.
+    mode: taint
+    pattern-sources:
+      # `basic-auth` package: const credentials = auth(req)  ->  { name, pass }.
+      # $REQ is constrained to conventional request-object names so an unrelated
+      # `auth(user)` / `auth(config)` call is not treated as a Basic-auth parse.
+      - patterns:
+          - pattern-either:
+              - pattern: auth($REQ)
+              - pattern: basicAuth($REQ)
+              - pattern: auth($REQ).pass
+              - pattern: auth($REQ).name
+              - pattern: basicAuth($REQ).pass
+              - pattern: basicAuth($REQ).name
+          - metavariable-regex:
+              metavariable: $REQ
+              regex: ^(req|request|ctx|context|c|r)$
+      # Proxy-Authorization header (base64 user:password, like Authorization).
+      - pattern: $REQ.headers['proxy-authorization']
+      - pattern: $REQ.headers["proxy-authorization"]
+      - pattern: $REQ.get('proxy-authorization')
+      - pattern: $REQ.get('Proxy-Authorization')
+      - pattern: $REQ.header('proxy-authorization')
+      - pattern: $REQ.header('Proxy-Authorization')
+    pattern-sanitizers:
+      # The username is not a secret: reading `.name` / `.username` off the
+      # decoded Basic credentials clears the taint, so logging only the username
+      # (`creds.name`) does not fire — only the password / raw header does.
+      - pattern: $C.name
+      - pattern: $C.username
+      # Redaction / masking helpers, or a truncating slice/substring — the value
+      # that reaches the log is no longer the live credential.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: maskToken(...)
+      - pattern: $S.slice(...)
+      - pattern: $S.substring(...)
+      - pattern: $S.substr(...)
+    pattern-sinks:
+      # console.log/info/debug/warn/error(...) — any tainted argument fires.
+      - patterns:
+          - pattern-either:
+              - pattern: console.log(...)
+              - pattern: console.info(...)
+              - pattern: console.debug(...)
+              - pattern: console.warn(...)
+              - pattern: console.error(...)
+      # logger.<level>(...) — a log-named receiver with a log-level method.
+      - patterns:
+          - pattern: $LOG.$LEVEL(...)
+          - metavariable-regex:
+              metavariable: $LOG
+              regex: (?i)^.*log(?:ger)?$
+          - metavariable-regex:
+              metavariable: $LEVEL
+              regex: ^(?:log|info|debug|warn|warning|error|trace|fatal|verbose|silly)$
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-014
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-basic-auth-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - express
+        - basic-auth
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://www.npmjs.com/package/basic-auth
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/flow/open-redirect.yml CHANGED Viewed

@@ -22,34 +22,55 @@ rules:
     # (isAllowedUrl, allowlist.includes, Set.has) clears the taint, so a
     # genuinely validated redirect does not fire.
     mode: taint
+    # `$REQ` is constrained to conventional request-object names so that
+    # unrelated receivers (`db.query`, `config.headers`, `someObj.body`) are not
+    # treated as untrusted request input.
     pattern-sources:
-      - pattern: $REQ.query
-      - pattern: $REQ.params
-      - pattern: $REQ.body
-      - pattern: $REQ.cookies
-      - pattern: $REQ.headers
-      - pattern: $REQ.query.$X
-      - pattern: $REQ.params.$X
-      - pattern: $REQ.body.$X
-      - pattern: $REQ.cookies.$X
-      - pattern: $REQ.headers.$X
-      - pattern: $REQ.query[$K]
-      - pattern: $REQ.params[$K]
-      - pattern: $REQ.body[$K]
-      - pattern: $REQ.cookies[$K]
-      - pattern: $REQ.headers[$K]
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.query
+              - pattern: $REQ.params
+              - pattern: $REQ.body
+              - pattern: $REQ.cookies
+              - pattern: $REQ.headers
+              - pattern: $REQ.query.$X
+              - pattern: $REQ.params.$X
+              - pattern: $REQ.body.$X
+              - pattern: $REQ.cookies.$X
+              - pattern: $REQ.headers.$X
+              - pattern: $REQ.query[$K]
+              - pattern: $REQ.params[$K]
+              - pattern: $REQ.body[$K]
+              - pattern: $REQ.cookies[$K]
+              - pattern: $REQ.headers[$K]
+          - metavariable-regex:
+              metavariable: $REQ
+              regex: ^(req|request|ctx|context|c|event|r)$
     pattern-sanitizers:
       # Routing the value through an allow-list / validation helper clears the
       # taint: only the vetted result (not the raw request input) reaches the
-      # sink. Matched by a conventional validation-helper call, or by an
-      # allow-list membership test (`Set.has` / `Array.includes`) that the
-      # value is passed through.
+      # sink.
       - pattern: isAllowedUrl(...)
       - pattern: validateRedirect(...)
       - pattern: sanitizeRedirect(...)
-      - pattern: $ALLOW.includes(...)
-      - pattern: $ALLOW.has(...)
-      - pattern: $ALLOW.indexOf(...)
+      # An inline allow-list membership guard vets the value: a value used inside
+      # `if (allow.has(x)) { ... }` / `if (allow.includes(x)) { ... }` /
+      # `if (allow.indexOf(x) ...) { ... }` is treated as validated. The
+      # boolean-returning membership call itself does NOT sanitize its argument
+      # (that would only clear the boolean, not the value), so we clear taint by
+      # the if-guard, mirroring the Python rule's `if is_safe_url(v): ...`.
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ALLOW.has($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ALLOW.includes($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ALLOW.indexOf($X) ...>) { ... }
     pattern-sinks:
       - patterns:
           - pattern-either:

package/rules/flow/ssrf.yml CHANGED Viewed

@@ -16,7 +16,7 @@ rules:
         - "**/*.spec.*"
         - "**/example/**"
         - "**/examples/**"
-        - "**/apps/**"
+        - "**/demo/**"
         - "**/docs/**"
         - "**/__mocks__/**"
         - "**/mocks/**"
@@ -42,34 +42,55 @@ rules:
     # (isAllowedUrl, allowlist.includes, Set.has) clears the taint, so a
     # genuinely vetted outbound request does not fire.
     mode: taint
+    # `$REQ` is constrained to conventional request-object names so that
+    # unrelated receivers (`db.query`, `config.headers`, `someObj.body`) are not
+    # treated as untrusted request input.
     pattern-sources:
-      - pattern: $REQ.query
-      - pattern: $REQ.params
-      - pattern: $REQ.body
-      - pattern: $REQ.cookies
-      - pattern: $REQ.headers
-      - pattern: $REQ.query.$X
-      - pattern: $REQ.params.$X
-      - pattern: $REQ.body.$X
-      - pattern: $REQ.cookies.$X
-      - pattern: $REQ.headers.$X
-      - pattern: $REQ.query[$K]
-      - pattern: $REQ.params[$K]
-      - pattern: $REQ.body[$K]
-      - pattern: $REQ.cookies[$K]
-      - pattern: $REQ.headers[$K]
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.query
+              - pattern: $REQ.params
+              - pattern: $REQ.body
+              - pattern: $REQ.cookies
+              - pattern: $REQ.headers
+              - pattern: $REQ.query.$X
+              - pattern: $REQ.params.$X
+              - pattern: $REQ.body.$X
+              - pattern: $REQ.cookies.$X
+              - pattern: $REQ.headers.$X
+              - pattern: $REQ.query[$K]
+              - pattern: $REQ.params[$K]
+              - pattern: $REQ.body[$K]
+              - pattern: $REQ.cookies[$K]
+              - pattern: $REQ.headers[$K]
+          - metavariable-regex:
+              metavariable: $REQ
+              regex: ^(req|request|ctx|context|c|event|r)$
     pattern-sanitizers:
       # Routing the value through a host allow-list / validation helper clears
       # the taint: only the vetted destination (not the raw request input)
-      # reaches the request. Matched by a conventional validation-helper call,
-      # or by an allow-list membership test (`Set.has` / `Array.includes`) that
-      # the value is passed through.
+      # reaches the request.
       - pattern: isAllowedUrl(...)
       - pattern: validateUrl(...)
       - pattern: assertAllowedHost(...)
-      - pattern: $ALLOW.includes(...)
-      - pattern: $ALLOW.has(...)
-      - pattern: $ALLOW.indexOf(...)
+      # An inline allow-list membership guard vets the value: a value used inside
+      # `if (allow.has(x)) { ... }` / `if (allow.includes(x)) { ... }` /
+      # `if (allow.indexOf(x) ...) { ... }` is treated as validated. The
+      # boolean-returning membership call itself does NOT sanitize its argument
+      # (that would only clear the boolean, not the value), so we clear taint by
+      # the if-guard, mirroring the Python rule's `if is_allowed_url(v): ...`.
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ALLOW.has($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ALLOW.includes($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ALLOW.indexOf($X) ...>) { ... }
     pattern-sinks:
       - patterns:
           - pattern-either:

package/rules/flow/timing-unsafe-compare.yml CHANGED Viewed

@@ -16,7 +16,7 @@ rules:
         - "**/*.spec.*"
         - "**/example/**"
         - "**/examples/**"
-        - "**/apps/**"
+        - "**/demo/**"
         - "**/docs/**"
         - "**/__mocks__/**"
         - "**/mocks/**"

package/rules/go/cookie/insecure.yml CHANGED Viewed

@@ -35,7 +35,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/go-cookie-insecure
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - net/http

package/rules/go/cors/allow-all.yml CHANGED Viewed

@@ -32,7 +32,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/go-cors-allow-all
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - gin

package/rules/go/flow/open-redirect.yml CHANGED Viewed

@@ -18,9 +18,11 @@ rules:
       redirecting. See CWE-601.
     # Taint mode so indirection (dest := r.FormValue("url"); http.Redirect(w,
     # r, dest, ...)) is caught, not just the inline form. The taint is cleared
-    # by an allow-list / validation helper that vets the destination, or by a
-    # url.Parse(...)-then-checked flow where the parsed value is inspected
-    # before use.
+    # by an allow-list / validation helper that vets the destination, or inside
+    # an `if`-guard that checks the parsed host against an allow-list. A bare
+    # `url.Parse(...)` is NOT a sanitizer: the parsed struct's Host/Path/Scheme
+    # are still attacker-controlled, so parse-then-reflect without a host check
+    # is a real open redirect and must still fire.
     mode: taint
     pattern-sources:
       # $R is the *http.Request. Cover the common net/http input shapes.
@@ -35,9 +37,17 @@ rules:
       - pattern: validateRedirect(...)
       - pattern: isAllowedRedirect(...)
       - pattern: $ALLOW.MatchString(...)
-      # url.Parse-then-checked: a parsed URL that has been inspected is treated
-      # as cleared (the result is rebuilt/validated rather than reflected raw).
-      - pattern: url.Parse(...)
+      # parse-then-host-checked: a value used inside an `if`-guard that looks the
+      # parsed host up in an allow-list map is treated as vetted, mirroring the
+      # Python rule's `if is_safe_url(...):` guard. A bare `url.Parse(...)` is
+      # deliberately NOT listed — it returns an attacker-controlled struct and
+      # does not validate anything, so parse-then-reflect still fires.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if $ALLOW[$U.Host] {
+                ...
+              }
     pattern-sinks:
       - patterns:
           - pattern-either:

package/rules/go/flow/ssrf.yml CHANGED Viewed

@@ -20,9 +20,11 @@ rules:
       link-local address ranges before dialing. See CWE-918.
     # Taint mode so indirection (target := r.FormValue("endpoint");
     # http.Get(target)) is caught, not just the inline form. The taint is
-    # cleared by an allow-list / host-validation helper, or by a
-    # url.Parse(...)-then-checked flow where the parsed host is vetted before
-    # the request is made.
+    # cleared by an allow-list / host-validation helper, or inside an
+    # `if`-guard that checks the parsed host against an allow-list. A bare
+    # `url.Parse(...)` is NOT a sanitizer: the parsed struct's Host/Path/Scheme
+    # are still attacker-controlled, so parse-then-use without a host check is a
+    # real SSRF and must still fire.
     mode: taint
     pattern-sources:
       # $R is the *http.Request. Cover the common net/http input shapes.
@@ -37,10 +39,17 @@ rules:
       - pattern: validateURL(...)
       - pattern: isAllowedHost(...)
       - pattern: $ALLOW.MatchString(...)
-      # url.Parse-then-checked: a parsed URL whose host has been inspected is
-      # treated as cleared (the request is built from a vetted destination
-      # rather than the raw untrusted string).
-      - pattern: url.Parse(...)
+      # parse-then-host-checked: a value used inside an `if`-guard that looks the
+      # parsed host up in an allow-list map is treated as vetted, mirroring the
+      # Python rule's `if is_allowed_url(...):` guard. A bare `url.Parse(...)` is
+      # deliberately NOT listed — it returns an attacker-controlled struct and
+      # does not validate anything, so parse-then-use still fires.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if $ALLOW[$U.Host] {
+                ...
+              }
     pattern-sinks:
       # Focus the URL argument so the finding lands on the tainted destination,
       # not the whole call. The plain call form is used (no aliasing) because

package/rules/java/cookie/insecure.yml CHANGED Viewed

@@ -22,7 +22,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-cookie-insecure
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - servlet

package/rules/java/cors/allow-all.yml CHANGED Viewed

@@ -38,7 +38,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-cors-allow-all
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - spring-web

package/rules/java/cors/credentialed-wildcard.yml CHANGED Viewed

@@ -34,7 +34,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-cors-credentialed-wildcard
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - spring-web

package/rules/java/flow/ssrf.yml ADDED Viewed

@@ -0,0 +1,113 @@
+rules:
+  - id: auth.java.flow.ssrf
+    languages:
+      - java
+    severity: ERROR
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. Globs intentionally omit `**/test/**`-style fixture paths
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/src/test/**"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/demo/**"
+        - "**/docs/**"
+    message: |
+      Untrusted request input flows into the URL of an outbound HTTP request.
+      Because the destination is attacker-controlled, this is a Server-Side
+      Request Forgery (CWE-918): an attacker can point the request at internal
+      services behind your firewall, or at the cloud metadata endpoint
+      (http://169.254.169.254/...) to steal IAM/instance credentials and pivot
+      deeper into your infrastructure.
+      Never build a request URL straight from a Spring `@RequestParam` /
+      `@RequestBody` value or a raw `HttpServletRequest.getParameter(...)` /
+      `getHeader(...)` value. Validate the destination against an explicit
+      allow-list of hosts (resolve the URL and check its host against the
+      allow-list, rejecting private/loopback ranges) before issuing the request
+      with `RestTemplate`, `WebClient`, OkHttp, or Apache HttpClient.
+    # Taint mode so indirection is caught — `String u = req.getParameter("url");
+    # restTemplate.getForObject(u, ...)` flags, not just the inline form.
+    # Passing the value through a host allow-list / validation guard
+    # (isAllowedUrl, validateUrl, assertAllowedHost, or an allow-list
+    # `contains(...)` if-guard) clears the taint, so a genuinely vetted
+    # outbound request does not fire.
+    mode: taint
+    pattern-sources:
+      # Spring MVC handler parameters annotated with @RequestParam / @RequestBody
+      # carry attacker-controlled request data. Focus the parameter so the taint
+      # tracks the value, not the whole method.
+      - patterns:
+          - pattern-either:
+              - pattern: "$RET $M(..., @RequestParam $T $P, ...) {...}"
+              - pattern: "$RET $M(..., @RequestParam(...) $T $P, ...) {...}"
+              - pattern: "$RET $M(..., @RequestBody $T $P, ...) {...}"
+          - focus-metavariable: $P
+      # Servlet API request accessors. Constrained to an HttpServletRequest
+      # receiver so unrelated `.getParameter(...)` / `.getHeader(...)` calls on
+      # other objects are not treated as untrusted input.
+      - pattern: (HttpServletRequest $REQ).getParameter(...)
+      - pattern: (HttpServletRequest $REQ).getParameterValues(...)
+      - pattern: (HttpServletRequest $REQ).getHeader(...)
+    pattern-sanitizers:
+      # Routing the value through a host allow-list / validation helper clears
+      # the taint: only the vetted destination (not the raw request input)
+      # reaches the request.
+      - pattern: isAllowedUrl(...)
+      - pattern: isAllowedHost(...)
+      - pattern: validateUrl(...)
+      - pattern: assertAllowedHost(...)
+      # An inline allow-list membership guard vets the value: a value used inside
+      # `if (allow.contains(...)) { ... }` is treated as validated, mirroring the
+      # Python rule's `if is_allowed_url(v): ...`. The boolean-returning
+      # membership call itself does NOT sanitize (that clears only the boolean),
+      # so taint is cleared by the if-guard.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if (<... $ALLOW.contains(<... $V ...>) ...>) { ... }
+    pattern-sinks:
+      # Focus the URL argument so the finding lands on the tainted destination,
+      # not the whole call.
+      - patterns:
+          - pattern-either:
+              # Spring RestTemplate.
+              - pattern: $RT.getForObject($URL, ...)
+              - pattern: $RT.getForEntity($URL, ...)
+              - pattern: $RT.postForObject($URL, ...)
+              - pattern: $RT.postForEntity($URL, ...)
+              - pattern: $RT.exchange($URL, ...)
+              - pattern: $RT.execute($URL, ...)
+              # Spring WebClient fluent URI.
+              - pattern: $WC.uri($URL)
+              - pattern: $WC.uri($URL, ...)
+              # OkHttp Request.Builder.
+              - pattern: $B.url($URL)
+              # Apache HttpClient request objects.
+              - pattern: new HttpGet($URL)
+              - pattern: new HttpPost($URL)
+              - pattern: new HttpPut($URL)
+              - pattern: new HttpDelete($URL)
+              - pattern: new HttpHead($URL)
+              # JDK URL/URI opened directly.
+              - pattern: new URL($URL)
+              - pattern: new URI($URL)
+          - focus-metavariable: $URL
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-FLOW-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-flow-ssrf
+      category: security
+      cwe: CWE-918
+      owasp: API7:2023
+      llm-prevalence: HIGH
+      technology:
+        - spring
+        - resttemplate
+        - webclient
+        - okhttp
+        - apache-httpclient
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/918.html

package/rules/java/session/fixation-disabled.yml CHANGED Viewed

@@ -25,7 +25,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-session-fixation-disabled
       category: security
       cwe: CWE-384
-      owasp: A07:2021
+      owasp: API2:2023
       llm-prevalence: MEDIUM
       technology:
         - spring-security

package/rules/java/tls/trust-all-certs.yml CHANGED Viewed

@@ -21,13 +21,24 @@ rules:
     # HttpClient's NoopHostnameVerifier. A HostnameVerifier with real
     # (non-trivial) logic and the default verifier are not matched.
     pattern-either:
-      # Lambda that always returns true: (hostname, session) -> true
-      - pattern: ($HOST, $SESSION) -> true
-      # Anonymous HostnameVerifier whose verify(...) just returns true.
-      - pattern: |
-          new HostnameVerifier() {
-            public boolean verify(String $H, SSLSession $S) { return true; }
-          }
+      # Lambda that always returns true, scoped to a hostname-verifier context
+      # so a generic two-arg lambda (BiPredicate, comparator, etc.) returning
+      # true is not mistaken for a permissive verifier.
+      - patterns:
+          - pattern: ($HOST, $SESSION) -> true
+          - pattern-either:
+              - pattern-inside: $X.setHostnameVerifier(...)
+              - pattern-inside: $X.setDefaultHostnameVerifier(...)
+      # Anonymous HostnameVerifier whose verify(...) just returns true, scoped to
+      # where it is actually installed as the verifier.
+      - patterns:
+          - pattern: |
+              new HostnameVerifier() {
+                public boolean verify(String $H, SSLSession $S) { return true; }
+              }
+          - pattern-either:
+              - pattern-inside: $X.setHostnameVerifier(...)
+              - pattern-inside: $X.setDefaultHostnameVerifier(...)
       # Apache HttpClient NoopHostnameVerifier (constructor or INSTANCE).
       - pattern: new org.apache.http.conn.ssl.NoopHostnameVerifier()
       - pattern: new NoopHostnameVerifier()

package/rules/oauth/no-state.yml CHANGED Viewed

@@ -14,14 +14,15 @@ rules:
       substitute for `state` when handling browser sessions.
     pattern-either:
       # Inline authorize URL carrying both client_id and response_type but no
-      # state. The path is not hardcoded (Google uses /o/oauth2/v2/auth, etc.).
-      - patterns:
-          - pattern-regex: |-
-              ['"]https?://[^'"\s]+\?[^'"]*client_id=[^'"]*['"]
-          - pattern-regex: |-
-              response_type=
-          - pattern-not-regex: |-
-              state=
+      # state, evaluated per quoted URL literal (the lookaheads/lookbehind are
+      # bounded to the contents of one string by `[^'"]`). This avoids the
+      # file-level false negative where a `state=` elsewhere in the file (a
+      # comment, a different correct call) would suppress a genuinely
+      # state-less URL. The path is not hardcoded (Google uses
+      # /o/oauth2/v2/auth, etc.). Single/double quotes only — a dynamic
+      # template-literal URL (backticks) is excluded.
+      - pattern-regex: |-
+          ['"]https?://(?=[^'"]*[?&]client_id=)(?=[^'"]*[?&]response_type=)(?![^'"]*[?&]state=)[^'"]+['"]
       # Programmatic URLSearchParams build (AST object match — robust to key
       # order and length). Fires when client_id + response_type are present but
       # state is not (covers both `state: x` and the `state` shorthand).

package/rules/oauth/open-redirect-callback.yml CHANGED Viewed

@@ -25,9 +25,24 @@ rules:
       - pattern: '$REQ.query[$K]'
       - pattern: '$REQ.body[$K]'
     pattern-sanitizers:
-      - pattern: '$SET.has(...)'
-      - pattern: '$ARR.includes(...)'
-      - pattern: '$ARR.indexOf(...)'
+      # An inline allow-list membership guard vets the value: a value used inside
+      # `if (set.has(x)) { ... }` / `if (arr.includes(x)) { ... }` /
+      # `if (arr.indexOf(x) ...) { ... }` is treated as validated. The
+      # boolean-returning membership call itself does NOT sanitize its argument
+      # (that would only clear the boolean, not the value), so we clear taint by
+      # the if-guard, mirroring the Python rule's `if is_safe_url(v): ...`.
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $SET.has($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ARR.includes($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ARR.indexOf($X) ...>) { ... }
     pattern-sinks:
       - patterns:
           - pattern-either:

package/rules/oauth/static-state.yml CHANGED Viewed

@@ -28,13 +28,14 @@ rules:
               - pattern: 'new URLSearchParams({..., state: "$S", ...})'
               - pattern: "new URLSearchParams({..., state: '$S', ...})"
       # Inline authorize URL string literal carrying both response_type and a
-      # constant state value. A dynamic state would be a template literal
-      # (backticks) with `${...}`, which this single/double-quoted form excludes.
-      - patterns:
-          - pattern-regex: |-
-              ['"]https?://[^'"\s]+\?[^'"]*response_type=[^'"]*['"]
-          - pattern-regex: |-
-              ['"]https?://[^'"\s]+\?[^'"]*state=[A-Za-z0-9._~%-]+[^'"]*['"]
+      # constant state value WITHIN THE SAME quoted literal. Using a single
+      # regex (lookaheads bounded by `[^'"]`) prevents the file-level false
+      # positive where `response_type=` in one string and a constant `state=`
+      # in a different string would otherwise combine into a finding. A dynamic
+      # state would be a template literal (backticks) with `${...}`, which this
+      # single/double-quoted form excludes.
+      - pattern-regex: |-
+          ['"]https?://(?=[^'"]*[?&]response_type=)(?=[^'"]*[?&]state=[A-Za-z0-9._~%-]+)[^'"]+['"]
     metadata:
       oauthlint-rule-id: AUTH-OAUTH-016
       oauthlint-doc-url: https://oauthlint.dev/rules/oauth-static-state

package/rules/py/cookie/insecure-flags.yml CHANGED Viewed

@@ -30,7 +30,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/py-cookie-insecure-flags
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - flask

package/rules/py/cors/allow-all.yml CHANGED Viewed

@@ -46,7 +46,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/py-cors-allow-all
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - flask-cors

package/rules/py/flow/requests-verify-disabled.yml CHANGED Viewed

@@ -41,7 +41,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-requests-verify-disabled
       category: security
       cwe: CWE-295
-      owasp: API8:2023
+      owasp: A02:2021
       llm-prevalence: HIGH
       technology:
         - requests

package/rules/rust/cookie/insecure.yml CHANGED Viewed

@@ -26,7 +26,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-cookie-insecure
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - cookie

package/rules/rust/cors/permissive.yml CHANGED Viewed

@@ -27,7 +27,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-cors-permissive
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - actix-web

package/rules/rust/flow/ssrf.yml ADDED Viewed

@@ -0,0 +1,90 @@
+rules:
+  - id: auth.rust.flow.ssrf
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the URL of an outbound HTTP request.
+      Because the destination is attacker-controlled, this is a Server-Side
+      Request Forgery (CWE-918): an attacker can point the request at internal
+      services behind your firewall, or at the cloud metadata endpoint
+      (http://169.254.169.254/...) to steal IAM/instance credentials and pivot
+      deeper into your infrastructure.
+      Never pass a request-derived `String` (an axum/actix handler parameter, or
+      a value taken from request input) straight into `reqwest::get(...)` or a
+      `Client::get(...)` / `Client::post(...).send()`. Validate the destination
+      host against an explicit allow-list (parse the URL and check the resolved
+      host/scheme, rejecting private/loopback/link-local ranges) before issuing
+      the request.
+    # Taint mode so indirection (let u = params.url; reqwest::get(u)) is caught,
+    # not just the inline form. The source is narrowed to function PARAMETERS
+    # (the shape an axum/actix handler takes its request data in) so an
+    # arbitrary local `let url = "https://constant"` is not treated as untrusted
+    # — only data arriving as a handler/function parameter is. The taint is
+    # cleared by an allow-list / host-validation if-guard, mirroring the Python
+    # and Go SSRF rules.
+    mode: taint
+    pattern-sources:
+      # A function parameter carrying request data: a bare `String` (the typical
+      # axum `String` / extracted field), or an axum `Query`/`Path` extractor
+      # (both the type-position and the destructured forms). Focus the parameter
+      # so the taint tracks the value rather than the whole function.
+      - patterns:
+          - pattern-either:
+              - pattern: "fn $F(..., $P: String, ...) {...}"
+              - pattern: "fn $F(..., $P: Query<$T>, ...) {...}"
+              - pattern: "fn $F(..., $P: Path<$T>, ...) {...}"
+              - pattern: "fn $F(..., Query($P): Query<$T>, ...) {...}"
+              - pattern: "fn $F(..., Path($P): Path<$T>, ...) {...}"
+          - focus-metavariable: $P
+    pattern-sanitizers:
+      # A value used inside an allow-list / host-validation if-guard is treated
+      # as vetted, so the guarded request does not fire. A bare `Url::parse(...)`
+      # is deliberately NOT a sanitizer: the parsed URL is still
+      # attacker-controlled, so parse-then-use without a host check must fire.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if is_allowed_url(<... $V ...>) {
+                  ...
+              }
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if validate_host(<... $V ...>) {
+                  ...
+              }
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if $ALLOW.contains(<... $V ...>) {
+                  ...
+              }
+    pattern-sinks:
+      # Focus the URL argument so the finding lands on the tainted destination.
+      - patterns:
+          - pattern-either:
+              - pattern: reqwest::get($URL)
+              - pattern: reqwest::blocking::get($URL)
+              - pattern: $C.get($URL).send()
+              - pattern: $C.post($URL).send()
+              - pattern: $C.put($URL).send()
+              - pattern: $C.delete($URL).send()
+              - pattern: $C.head($URL).send()
+              - pattern: $C.request($M, $URL).send()
+          - focus-metavariable: $URL
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-FLOW-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-flow-ssrf
+      category: security
+      cwe: CWE-918
+      owasp: API7:2023
+      llm-prevalence: HIGH
+      technology:
+        - reqwest
+        - axum
+        - actix-web
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/918.html

package/rules/tls/reject-unauthorized.yml CHANGED Viewed

@@ -31,7 +31,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/tls-reject-unauthorized
       category: security
       cwe: CWE-295
-      owasp: A05:2021
+      owasp: A02:2021
       llm-prevalence: HIGH
       technology:
         - node